Scrawlspace › Developer Utilities
Hash Generator (SHA-256, MD5, HMAC)
Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files at once, optionally as an HMAC with a secret key, and check them against a published checksum. Hashing runs in your browser, so files up to 1 GB are hashed without being uploaded, with no sign-up.
How to use Hash Generator
- Type or paste text into Input, or click Hash a file (or drop one on the page).
- Optionally tick HMAC with a secret key, enter the Key and choose its encoding: Text, Hex or Base64.
- Choose the Output format: hex, HEX or Base64. All five algorithms are shown together.
- Paste an expected checksum into Compare with; the matching hash is highlighted.
Frequently asked questions
How do I check the SHA-256 checksum of a file?
Click Hash a file, choose the download, and paste the published SHA-256 into Compare with. The tool tells you whether it matches. On the command line it's sha256sum file on Linux, shasum -a 256 file on macOS, and certutil -hashfile file SHA256 or Get-FileHash in PowerShell on Windows.
Why doesn't my hash match the one from the command line?
Most often a trailing newline: echo "abc" | sha256sum hashes abc plus a line break. Use echo -n or printf to match. Other causes are Windows (CRLF) vs Unix (LF) line endings, or comparing hex with Base64. Text here is hashed as the exact UTF-8 bytes you type.
Is MD5 still secure?
No. MD5 and SHA-1 are fine for spotting accidental changes but are broken for security uses, because collisions can be made deliberately. Use SHA-256 or stronger for anything that matters.
Can I use SHA-256 to store passwords?
No. Fast hashes can be guessed billions of times a second. Store passwords with a slow, salted password hash such as Argon2id, bcrypt or scrypt. To create strong passwords in the first place, use the password generator.
What is HMAC?
HMAC (RFC 2104) combines a hash with a secret key, so only someone with the key can produce or check the value. It's used to sign API requests and webhooks, and HS256 JWTs are signed with HMAC-SHA256.
Is hashing the same as encoding?
No. A hash is one-way: you can't get the input back, and changing one character changes the whole result. Encoding such as Base64 is reversible by anyone.
Are my files uploaded to be hashed?
No. Files and text are hashed in your browser.
Digest sizes
SHA-1 and the SHA-2 family are defined in FIPS 180-4; MD5 in RFC 1321. A hex digest has two characters per byte.
| Algorithm | Bits | Hex characters | Status |
|---|---|---|---|
| MD5 | 128 | 32 | Broken for security. Checksums only. |
| SHA-1 | 160 | 40 | Broken for security. Checksums only. |
| SHA-256 | 256 | 64 | Secure. The usual choice for checksums and signatures. |
| SHA-384 | 384 | 96 | Secure. Used in Subresource Integrity and some TLS suites. |
| SHA-512 | 512 | 128 | Secure. Often faster than SHA-256 on 64-bit CPUs. |
Why doesn't my hash match?
- A trailing newline, from echo without -n or from a text editor that adds one at the end of a file.
- Different line endings: a file saved on Windows uses CRLF, the same text on Linux uses LF.
- A different text encoding. This tool hashes UTF-8; UTF-16 text gives a different hash.
- Hex vs Base64 output. They are the same bytes written differently.
- Hashing the text you copied from a file instead of the file itself.
- For HMAC, the key's encoding: a hex or Base64 key entered as plain text gives a different result.
Test values
Use these to check the tool or your own code. SHA-256 of abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. SHA-256 of abc with a trailing newline is edeaaff3f1774ad2888673770c6d64097e391bc362d7d6fb34982ddf0efd18cb. HMAC-SHA256 of The quick brown fox jumps over the lazy dog with the key key is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8.