What a hash is
A hash function turns any input — a word or a 4 GB file — into a short, fixed-length fingerprint. The same input always gives the same digest, and changing a single bit gives a completely different one. It is one-way: there is no going back from the digest to the input.
- SHA-256The default for download checksums, Docker image digests and digital signatures.
- SHA-512A longer digest from the same family, often faster on 64-bit machines.
- SHA-1 and MD5Broken for security — collisions can be made on purpose. Fine for spotting accidental corruption.
- HMACA hash keyed with a secret. Proves who sent a message — the basis of most webhook signatures.
Verify a download
Projects publish the SHA-256 of each release. Hash the file you downloaded and compare: if a single byte differs — a broken download or a tampered file — the digests will not match. Drop the file above and paste the published checksum into Verify, or use your terminal:
shasum -a 256 release.zip # compare with a published checksum file shasum -a 256 -c release.zip.sha256
sha256sum release.zip # compare with a published checksum file sha256sum -c release.zip.sha256
# PowerShell Get-FileHash release.zip -Algorithm SHA256 # Command Prompt certutil -hashfile release.zip SHA256
How to use the hash generator
- Type text in Text, or switch to File and drop a file.
- Every digest appears at once: SHA-256, SHA-384, SHA-512, SHA-1 and MD5.
- Pick Hex, HEX or Base64 — Base64 is what headers and Subresource Integrity use.
- Tick HMAC With Key and enter the secret to sign the input instead of plainly hashing it.
- Paste a published checksum into Verify; the matching row lights up.
Examples
Verify a downloaded file
A file and its published SHA-256 — the row turns green when they match.
Check a webhook signature
HMAC-SHA-256 of a payload with a shared secret, as GitHub and Stripe send it.
Find out why hashes differ
echo adds a newline. The tool notices and says so.
Make a Subresource Integrity value
SHA-384 in Base64 is the integrity attribute for a script tag.
Frequently asked questions
Should I hash passwords with SHA-256?
No. SHA-256 is designed to be fast, so an attacker with a leaked database can try billions of guesses per second. Store passwords with a slow, salted password hash — Argon2id, bcrypt or scrypt — through your framework's password library.
Is MD5 still safe to use?
For catching accidental corruption, yes. For anything an attacker could influence, no: two different files with the same MD5 can be produced in seconds. The same is true, more slowly, for SHA-1. Use SHA-256.
Why is my hash different from the command line?
Usually an invisible difference in the input: echo adds a trailing newline (echo -n does not), Windows files end lines with CRLF, and text may be in a different encoding than UTF-8. This page hashes text as UTF-8 and points out a trailing newline.
Is my file uploaded?
No. The file is read from your disk into this page and hashed there. Check the Network tab in your developer tools while you hash it.
How large a file can I hash?
Up to 200 MB. Hashing runs in the background so the page stays responsive; for larger files use sha256sum or Get-FileHash.