Hash Generator
This SHA256 generator also makes MD5, SHA-1, SHA-384 and SHA-512 hashes of text or files, checks a download against its published checksum, and creates HMAC signatures.
Everything runs in your browser. Nothing you type is sent or stored.
How to use Hash Generator
Choose "Text", "File checksum" or "HMAC".
Type the text or choose the file (for HMAC, also enter the secret key), then click the generate button.
Copy a hash, or paste the expected checksum to see whether it matches.
When to use Hash Generator
- Verifying downloads. Check an ISO, app or driver against the SHA-256 checksum on the download page.
- Developers. Generate test hashes and HMAC signatures for APIs and webhooks.
- Spotting changed files. Two files with the same SHA-256 are identical.
Hashes are not for storing passwords
Fast hashes such as MD5, SHA-1 and even SHA-256 are designed to be quick, which makes them easy to brute-force if used to store passwords. Websites should store passwords with a slow, salted password-hashing function such as Argon2, bcrypt or scrypt. Use the hashes on this page for checksums and integrity checks.
Limits and privacy
- Files up to 500MB; large files take longer because they are read fully into memory.
- MD5 and SHA-1 are broken for security purposes but still common for checksums.
- Everything runs in your browser. Nothing you type is sent or stored.
Frequently asked questions
How do I check a file checksum?
Choose "File checksum", select the downloaded file and click "Generate hashes". Then paste the checksum from the official download page into "Compare with an expected checksum". A green "Match" means the file is complete and unchanged; no match means it is corrupted, incomplete or not the same file.
Is MD5 secure?
Not for security. Researchers can create different files with the same MD5 hash, and SHA-1 has similar weaknesses. They are still fine for spotting accidental corruption. For anything security-related, such as verifying software, use SHA-256 or SHA-512.
Which hash should I use?
Use SHA-256 for checksums and integrity checks; it is the current standard and widely published. Use SHA-512 if a system asks for it. For signing messages with a shared secret, use HMAC-SHA256. For storing passwords, use Argon2 or bcrypt instead of any of these.
Is my file sent to a server?
No. Files are hashed in your browser using its built-in Web Crypto functions. Nothing is sent to a server, so you can safely check private files.
Related tools
Something not working with Hash Generator? Report a problem.