Hash generator and file checksum
Type text or drop a file to see its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 together. Paste the checksum a download page gave you to see if it matches. Nothing is uploaded: the hashing runs in this page.
13 bytes as UTF-8, 13 characters
Hashes
Working it out…
Compare with an expected hash
Paste a checksum to see whether it matches. Case and spaces are ignored, and the algorithm is picked from the length.
Hex and Base64 values are both understood. If you turned HMAC on, the comparison is against the HMAC values.
What a hash does and does not tell you
MD5 and SHA-1 have known collision attacks, so do not use them for signatures, certificates or storing passwords. They are still fine for checking that a file was not damaged by accident, for example during a download. Use SHA-256 or longer when security matters.
A matching hash proves the file equals whatever the hash was made from. If the hash sits on the same site as the download, someone who could change the file could change the hash too, so it does not prove who made the file.
How it works
- •Text is turned into bytes as UTF-8 first, and the byte count is shown, because that is what gets hashed. The same word typed with different accents or emoji can therefore have a different length than you expect. A file is hashed as its raw bytes.
- •SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser's own Web Crypto. Browsers do not offer MD5, so this page contains its own MD5 (RFC 1321) that reads the file in 4 MB pieces. Files up to 200 MB are accepted; the whole file is held in memory while it is hashed.
- •With HMAC on, the secret key is mixed in as described in RFC 2104, so the result can only be reproduced by someone who knows the key. Keys longer than the algorithm's block size are handled as the standard says, and an empty key is allowed.
- •For the comparison box, the page removes spaces, ignores upper and lower case for hex, and picks the algorithm from the length: 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. Base64 values of the matching lengths are understood too.
- •The MD5 code and the HMAC were checked against the RFC 1321 and FIPS 180 test values and against the macOS md5, shasum and openssl tools and Python for several hundred inputs.
Questions
- Is my file or text uploaded?
- No. The text and the file are read and hashed by code running in this page, and nothing is sent anywhere. The HMAC key you type stays on the page too.
- Is MD5 safe to use?
- Not for security. People can build two different files with the same MD5 or SHA-1, so neither should be used for signatures, certificates or password storage. For checking that a download was not corrupted on the way, they still work. For anything where an attacker matters, use SHA-256 or SHA-512.
- The hash matches. Does that mean the file is safe?
- It means the file is identical to whatever the hash was made from. If the hash is on the same web page as the download, a person who could swap the file could swap the hash too. Get the checksum from a different, trusted place, or use the publisher's signature when one exists.
- Why is my hash different from another tool's?
- Most often the input is not the same: a trailing newline, Windows line endings, or text hashed from a file that was saved in another encoding. Check the byte count shown here against the other tool. For files, hash the file itself, not a copy you opened and saved again.