Hash Generator

A hash is a short fingerprint of some data. Change one letter or one byte and the fingerprint changes completely, which is why download pages publish them: if the SHA-256 of the file on your computer matches the one on the website, you have exactly the file they meant you to have, with nothing damaged or swapped along the way.

This tool works out MD5, SHA-1, SHA-256, SHA-384 and SHA-512 together, live as you type, so you never have to guess which one a page wants. Drop in files instead and each one is read in 4 MB pieces by background workers, with a progress bar, so a multi-gigabyte disk image works as well as a photo. Paste the expected checksum into “Check a checksum” and it tells you in green or red whether anything matches.

Developers get the extras: hex, Base64 or Base64url output, HMAC signing with a key typed as text, hex or Base64, and a webhook checker that says whether a Stripe, GitHub, Shopify or Slack request really came from them, following each provider’s signing rules with a constant-time comparison. Everything is calculated on your device; text, files, keys and secrets are never uploaded.

1. Choose “Text” to type or paste, or “Files” to drop or choose one or more files.
2. Read the hashes as they appear. Tap an algorithm chip to hide ones you don’t need, and pick “hex”, “HEX”, “Base64” or “Base64url”.
3. To sign with a key, tick “HMAC with a secret key”, type the key and say whether it is text, hex or Base64.
4. Paste a published checksum into “Check a checksum”. A green box means a match; red means the data differs.
5. Press the copy button on any row, “Copy all” for a card, or “Save as .txt” to keep a checksum list for your files.
6. To check a webhook, pick the provider under “Check a webhook signature” and paste the secret, the signature header and the raw body. “Try an example” shows how it works.

• MD5, SHA-1, SHA-256, SHA-384 and SHA-512 shown together and updated on every keystroke.
• Files of any size, read in 4 MB pieces with a progress bar, time left and a Stop button.
• Several files at once, each with its own result card.
• HMAC for all five algorithms, with the key written as text, hex or Base64.
• Output as lower-case hex, upper-case hex, Base64 or Base64url (the URL-safe form used in JWTs).
• Webhook signature checks for Stripe (t= and v1=, with a timestamp tolerance), GitHub (sha256=), Shopify (Base64) and Slack (v0=), using a constant-time comparison, plus the signature you should have received when it doesn’t match.
• Checksum checker that accepts bare hex or Base64, sha256sum and macOS shasum lines, and SRI values such as sha384-….
• “Save as .txt” writes a checksum list in the same layout as the sha256sum command.
• Text is hashed as UTF-8, as nearly every other tool and language does.

• If a checksum doesn’t match, download the file again first: interrupted downloads are far more common than tampering.
• For text, a hidden space or line break at the end changes the hash, so check the very end if results differ.
• Use SHA-256 or SHA-512 whenever you choose. MD5 and SHA-1 are fine for catching accidental damage, but people can now deliberately make two different files with the same MD5 or SHA-1.
• Never store passwords as a plain hash from any tool. Real systems use slow, salted methods such as bcrypt or Argon2.
• A webhook check needs the raw body exactly as sent. A framework that parses the JSON and writes it out again changes spaces or key order, and the signature stops matching.