What is a hash function?
A hash function takes any input — text or a file — and produces a fixed-length fingerprint of it. The same input always produces the same hash, and changing even one character produces a completely different one. That makes hashes useful for verifying a file wasn't corrupted or tampered with (checksums), and for storing things like passwords without keeping the original value. Hashing is one-way: you can't recover the original input from the hash.
How to use this tool
- 1 Type or paste text, or switch to File mode and drop a file to hash it.
- 2 All five algorithms — MD5, SHA-1, SHA-256, SHA-384, SHA-512 — compute at once, live.
- 3 To compute an HMAC instead of a plain hash, check "Use HMAC" and enter a secret key (text mode only).
- 4 Click the copy icon next to any hash to grab it.
Frequently asked questions
Is my text or file uploaded anywhere?
No. Every hash is computed locally — SHA-family hashes via the browser's native Web Crypto API, MD5 via a small JavaScript implementation since browsers don't provide it natively. Nothing you type or upload leaves your device.
Which algorithm should I use?
For anything security-sensitive (password storage, digital signatures), use SHA-256 or stronger — MD5 and SHA-1 are cryptographically broken and only suitable for non-adversarial checks like verifying a download wasn't corrupted.
What is HMAC and when do I need it?
HMAC combines a hash function with a secret key, so the result proves both that the message was not altered and that whoever produced it knew the key. Use it when verifying a webhook signature or an API request signature — a plain hash alone does not prove authenticity, only integrity.
Can I hash a large file?
Yes — files are read and hashed entirely in memory in your browser. SHA-family hashing is fast at any size; MD5 runs in pure JavaScript, so very large files (hundreds of MB) may take a few seconds.
Why do MD5 and SHA-1 still exist here if they're "broken"?
They're broken for security purposes (collisions can be engineered) but are still widely used for non-adversarial checksums — e.g. many download pages still publish an MD5 or SHA-1 alongside SHA-256, so we compute all of them for compatibility.