Hash Generator

Hashes are easiest to understand with known inputs. Type these into the text box (without quotes) and compare the digests; they are the same values any correct implementation produces.

Changing one capital letter produces an unrelated SHA-256 digest, and even empty input has a fixed hash. Switch the output to Base64 and the SHA-256 of hello becomes LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ= — the same 32 bytes, just encoded differently. To reproduce a value on the command line without adding a newline:

printf '%s' 'hello' | sha256sum
printf '%s' 'hello' | openssl dgst -sha256 -hmac 'secret'

Every algorithm row is computed at once from the same input bytes. Digest length tells you which algorithm produced a hash you found elsewhere:

• Hex is lowercase by default; Uppercase only changes letter case, not the value, and is disabled in Base64 mode.
• With HMAC on, the row labels change to HMAC-SHA-256 and so on, and every digest depends on the secret key as well as the input.
• Verify compares a pasted value against every row. Hex is matched case-insensitively and spaces or colons are ignored, so a fingerprint like AA:F4:C6:… works; Base64 must match exactly. A match highlights the row and names the algorithm.
• The status bar shows the source (text or file), the number of input bytes and the output encoding — a quick way to spot an unexpected extra byte.

• Verifying a download. Switch to File, drop the file in and paste the publisher's SHA-256 checksum into Verify . A match means the file is byte-for-byte what the checksum describes; it only proves authenticity if the checksum itself came from a trusted source.
• Debugging webhook signatures. Many providers sign the raw request body with HMAC-SHA-256. GitHub, for example, sends X-Hub-Signature-256: sha256=<hex digest> . Paste the exact body, enable HMAC with your secret, and compare the hex part.
• Comparing two values. Hash two configuration files or text blocks and compare short digests instead of the full content; use the Base64 tool if one side is Base64-encoded.
• Generating cache keys and identifiers where you need a stable fingerprint of some content, not secrecy.

A trailing newline

echo hello | sha256sum hashes hello plus a newline, giving 5891b5b5…6be03 instead of 2cf24dba…b9824. Use printf '%s' or echo -n, or check the byte count in the status bar.

Line endings and character encoding

Text is encoded as UTF-8 before hashing, so accented letters, emoji and non-Latin scripts must also be UTF-8 on the other side. Browsers normalize line breaks typed or pasted into a text box to LF, so text copied from a file with Windows CRLF line endings will not match the file's hash. Use File mode when you need the exact bytes.

Verify says "no match" for the right value

Strip prefixes such as sha256= or SHA256 (file) = and paste only the digest. Base64url values (with - and _, often without = padding) are not recognized; convert them to standard Base64 or compare the hex form instead.

HMAC differs from the server's signature

The key is used as UTF-8 text exactly as typed. If your secret is meant to be decoded from hex or Base64 first, this tool cannot do that step. Also make sure you hash the raw body: re-formatting JSON changes the bytes and therefore the signature. If the key field is empty, the SHA rows can show a dash because Web Crypto refuses a zero-length HMAC key.

• A hash is not encryption. There is no key to reverse it, and short or common inputs can be found by guessing — which is why lookup sites can "crack" the MD5 of a dictionary word.
• MD5 and SHA-1 are broken for collision resistance. Attackers can create two different inputs with the same digest, so do not use them for signatures, certificates or any integrity check an attacker could influence.
• Fast hashes are not password storage. SHA-256 and SHA-512 are designed to be fast, which helps attackers test billions of guesses. Store passwords with a dedicated password hashing function such as Argon2id, bcrypt or scrypt, with a unique salt per password. This tool does not compute those.
• Supported algorithms only. The tool offers MD5, SHA-1, SHA-256, SHA-384 and SHA-512, plus HMAC with each. It does not compute SHA-3, BLAKE2/BLAKE3, CRC32 or SHA-224.
• Files are read into memory. Hashing happens in the browser, so very large files may be slow or fail depending on your device's memory.

To check the TLS certificate of a live site, use the SSL Checker. To inspect a signed token rather than a raw digest, use the JWT Decoder.