Free tool· Security & keys
Hash and sign text or files — SHA-256, MD5, HMAC and more
Every common digest at once for text or a file, HMAC signatures with a secret key in text, hex or base64, and a compare box that checks a published checksum against all of them. Computed on your device.
- Runs in your browser
- Free, no signup
- Updated
HMAC (optional)
Hashes
Nothing to hash yet
Compare with an expected hash
Paste the checksum published with a download — it is matched against every row.
Command line
$ openssl dgst -md5 file.txt $ openssl dgst -sha1 file.txt $ openssl dgst -sha256 file.txt $ openssl dgst -sha384 file.txt $ openssl dgst -sha512 file.txt $ crc32 file.txt
Text is hashed as UTF-8 bytes, exactly as typed — a trailing newline changes every hash.
About this tool
What is the Hash & HMAC Generator?
The Hash & HMAC Generator is a free tool that computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 for text or files, and HMAC signatures with a secret key, entirely in your browser. A compare box checks a published checksum against every algorithm at once.
- Price
- Free
- Signup
- None
- Your data
- Stays in your browser
- Updated
What you get
- Six digests at once: MD5, SHA-1, SHA-256/384/512, CRC-32
- HMAC with text, hex or base64 keys
- Files up to 200 MB hashed on your device
- Hex, upper-case hex or base64 output
- Checksum compare and matching command-line commands
Security & keys · no account, nothing uploaded
How it works · three steps, no signup
How to use the Hash & HMAC Generator
Step 1: Add text or a file
Type or paste text, or drop a file up to 200 MB. Text is hashed as UTF-8 bytes, exactly as entered.
Step 2: Pick the output
Hex, upper-case hex or base64 — and switch on HMAC to sign with a secret key instead of hashing plainly.
Step 3: Copy or compare
Copy any digest, or paste an expected checksum to see instantly which algorithm, if any, it matches.
FAQ
Hash & HMAC Generator: questions and answers
Which hash should I use?
SHA-256 for almost everything: file checksums, content IDs and signatures. SHA-384 and SHA-512 are equally safe with longer output. MD5 and SHA-1 are broken for security — collisions can be manufactured — so use them only to match a legacy checksum. CRC-32 detects accidental corruption, not tampering.
What is the difference between a hash and an HMAC?
A hash fingerprints data; anyone can recompute it. An HMAC mixes in a secret key, so only someone holding the key can produce the right value. That is how WhatsApp webhooks, payment callbacks and API requests prove they are genuine: the sender signs the body with a shared secret and the receiver recomputes the HMAC to compare.
Why does my hash differ from the command line?
Almost always because the input bytes differ. Text here is hashed as UTF-8 exactly as typed; echo adds a trailing newline (use echo -n or printf), Windows files may use CRLF line endings, and some tools hash a hex or base64 string rather than the bytes it represents. Hashing the file itself avoids all of these.
Are my files uploaded?
No. Files are read into your browser's memory and hashed there with WebCrypto; nothing is sent anywhere, which is why the size limit is 200 MB. For larger files use the command shown under the results.
Is MD5 or SHA-1 still safe to use?
Not for security. Practical collision attacks exist for both, so neither should protect signatures, certificates or anything an attacker can influence. They are still fine as fast checksums for accidental corruption, deduplication and legacy systems. Use SHA-256 or stronger for integrity, HMAC-SHA256 for message signatures, and a slow password hash such as Argon2id, scrypt or bcrypt for passwords — never a plain hash.
Still have questions?
Book a demoMore free tools
Keep your stack sharp
Ready to do this at scale?
InfiQ puts broadcasts, chatbots, a shared inbox and the developer API behind one dashboard — on the official WhatsApp Business API. 7-day free trial, no card required.