Hash Generator

How to use the hash generator

1. Stay on the 📝 Text tab and type or paste your input. SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 are all computed at once, updating as you type.
2. Switch the output to Base64 or turn on uppercase hex if that is what the system you are feeding expects — the bytes are identical either way.
3. Use the 📁 File tab to drop a file of any size. It is read in 4 MB chunks with a progress bar, so a multi-gigabyte ISO does not freeze the tab.
4. Use the 🔑 HMAC tab to add a secret key. Pick the underlying SHA algorithm and you get the same value your server library would produce.
5. Use the ⚖️ Compare tab to paste the hash from a download page and the hash you just computed — you get a ✅ or ❌ instead of squinting at 64 hex digits.

How hashing works

A cryptographic hash squeezes an input of any length into a fixed-length digest. Three properties make it useful: the same input always produces the same output, a one-bit change produces a completely different output, and finding two inputs with the same output must be infeasible.

CRC32 is the odd one out. It is not cryptographic at all — it is a cyclic redundancy check built from the polynomial 0xEDB88320, table-driven, and computed byte by byte. That also means it can be streamed, so this tool updates it chunk by chunk while reading a file. The SHA algorithms go through the browser’s built-in Web Crypto implementation, which has no incremental API, so the file bytes are collected first and hashed in one pass.

Worked examples

Checking a download. A project publishes SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Drop the file on the File tab, paste both values into Compare, and read the ✅. That particular digest is the hash of zero bytes, so if you ever see it, your download is empty.

The famous test vector. SHA-256("abc") is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, and the same bytes in Base64 are ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=. Both appear in the NIST documents; this tool reproduces them exactly.

A CRC32 you can check by hand. The standard check value for CRC32 is CRC32("123456789") = cbf43926. Every correct implementation on earth agrees on that number, which makes it the quickest way to test one.

Signing a webhook. With the key Jefe and the message what do ya want for nothing?, HMAC-SHA-256 gives 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843 — test case 2 from RFC 4231. If your server produces something else, the bug is in how you encoded the key or the body, not in the algorithm.

Hashing is not encryption

This is the single most common misunderstanding, so it is worth stating plainly. Encryption is reversible with a key; hashing is not reversible at all. A digest is a fingerprint, not a locked box.

Two consequences follow. First, you cannot “decrypt” a hash, and any site claiming to do so is really searching a dictionary of pre-computed digests. Second, a hash on its own does not protect a password: because the same password always produces the same digest, an attacker with a stolen database can test billions of guesses per second. Passwords need a slow, salted function such as bcrypt, scrypt or Argon2 — never a bare SHA-256.

Tips and common mistakes

• Hash bytes, not characters. This tool encodes text as UTF-8 first. If your backend uses UTF-16 or Latin-1, the digests will differ for any non-ASCII input.
• Mind the trailing newline. sha256sum on a text file includes the final newline; a textarea usually does not. That one byte changes everything.
• Compare in constant time on a server. Using === on a signature leaks timing information. This page’s comparison is for humans, not for authentication code.
• Do not truncate digests. Taking the first 8 characters of a SHA-256 to make a “short id” drops you to 32 bits, where collisions appear after about 77,000 items.
• Upper and lower case hex are the same value. Normalise before comparing; the Compare tab already does.
• HMAC keys are bytes. If your key is a hex string, decode it to bytes first — feeding the hex text as UTF-8 gives a different, wrong signature.

Glossary

• Digest – the fixed-length output of a hash function.
• Collision – two different inputs that hash to the same digest.
• HMAC – hash-based message authentication code; a keyed hash defined in RFC 2104.
• Secure context – a page served over HTTPS or from localhost, the only place Web Crypto is available.
• Salt – random data added to a password before hashing so identical passwords get different digests.

Privacy

Text and files are hashed inside your browser tab using the Web Crypto API that ships with the browser itself. Dropped files are read with the File API in 4 MB chunks and never leave your machine — there is no upload request, no progress reporting to a server, and no temporary storage. HMAC keys are held in memory for as long as the field contains them and are gone when you close the tab. Because nothing is transmitted, you can safely hash a private document, a signing key or an internal build artefact here.

Last reviewed: September 21, 2026