# Hash generator

> Hash text or a file with MD5, SHA-1, SHA-256, SHA-384 or SHA-512, in hex or Base64. Computed in your browser; nothing is uploaded.

Canonical: https://toolspace.tech/hash-generator/
Last updated: 2026-10-25

Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hash of text or a file, in hex or Base64. Paste an expected checksum to see if a download matches.

This is an interactive tool that runs in the browser: [open the Hash generator](https://toolspace.tech/hash-generator/) to use it. Nothing typed into it is uploaded.

## Worked example

The classic test sentence, hashed as UTF-8 text with no trailing newline.

**text**

```
The quick brown fox jumps over the lazy dog
```

**MD5 · SHA-256**

```
9e107d9d372bb6826bd81d3542a419d6
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
```

## Common mistakes

### Hashing a trailing newline by accident

Text copied from a terminal or saved by an editor often ends with a line break. One extra byte gives a completely different hash.

### Storing passwords as SHA-256

Fast hashes are easy to brute-force. Use a password hashing function such as Argon2id or bcrypt, with a salt.

### Trusting MD5 to prove a file is genuine

MD5 catches corruption, but an attacker can craft a different file with the same MD5. Compare SHA-256 when it’s published.

### Comparing hex in different cases

A9993E… and a9993e… are the same hash. The compare box ignores case, spaces and a trailing file name.

## How it works

1. **Type text or drop a file:** Text is hashed as UTF-8 as you type. Files of any type up to 200 MB are read on your device and never uploaded.
2. **Read the hashes:** All five appear at once, in lower-case hex, upper-case hex or Base64, each with its own copy button. Turn on HMAC to hash text with a secret key.
3. **Check a checksum:** Paste the hash a website publishes for a download. The tool tells you which algorithm matches, or that nothing does.

## Questions

### Which hash should I use?

SHA-256 for checksums and anything new. MD5 and SHA-1 are still fine for spotting accidental corruption, but people can deliberately create two different files with the same MD5 or SHA-1 hash, so don’t rely on them for security.

### Can I hash passwords with this?

Not for storing them. Plain SHA-256 or MD5 is far too fast: attackers can try billions of guesses a second. Password storage needs a slow algorithm like Argon2, bcrypt or scrypt.

### Why is my hash different from the one my command line gives?

Usually a trailing newline. echo "abc" | sha256sum hashes "abc" plus a newline; use echo -n. Line endings (CRLF vs LF) and text encoding also change the bytes, and so the hash.

### What is HMAC?

A hash mixed with a secret key, used to sign API requests and webhooks. Only someone with the key can produce the same value. The tool offers HMAC-SHA-1, SHA-256, SHA-384 and SHA-512; the key stays in memory and is never saved.

### Is my file uploaded?

No. The browser reads the file locally and hashes it in this tab. SHA hashes use the built-in Web Crypto API; MD5 is computed in the page.

## Related

- [Base64 encoder](https://toolspace.tech/base64-encode-decode/)
- [UUID generator](https://toolspace.tech/uuid-generator/)
- [Password generator](https://toolspace.tech/password-generator/)
- [JWT decoder](https://toolspace.tech/jwt-decoder/)