Hash Generator & File Verifier
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or any file. Verify file integrity and compute HMAC signatures — 100% private, nothing uploaded.
Hashes update live as you type — nothing is sent to a server.
Your files and text are never uploaded — all hashing runs in your browser.
What Can You Do With This Tool?
Verify Downloaded Files
Software publishers list SHA-256 or MD5 checksums next to their download links so you can confirm the file was not tampered with in transit. Drop the file into the File & Verify tab, paste the expected hash, and you get an instant ✅ or ❌ — no command line required.
Debug Webhook Signatures
Stripe, Slack, GitHub, and AWS all use HMAC-SHA256 to sign webhook payloads. If your server is rejecting events with "invalid signature", paste the raw payload and your signing secret into the HMAC tab to compute the expected signature and compare it to what you received.
Document File Checksums
Drop multiple files at once in batch mode to get a SHA-256 hash for each one. Download the result as a standard checksums.sha256 file — the same format used by Linux distributions and package managers — so recipients can verify your files later with sha256sum -c.
Hash Passwords or Tokens for Testing
Need to quickly check what SHA-256 or MD5 of a known string produces — for a unit test, a database seed, or a debugging session? Paste the string in the Text tab and all five algorithms update live as you type.
Frequently Asked Questions
What is a cryptographic hash?
A hash function maps any input — a word, a document, a 4 GB video — to a fixed-length hex string called a digest. The same input always produces the same digest, but even a single changed byte produces a completely different one. This makes hashes useful for verifying that a file or message arrived intact.
Which algorithm should I use?
SHA-256 is the current standard for file integrity checks and most security-sensitive uses. SHA-512 provides a larger digest (128 hex characters) and slightly higher security margin. MD5 and SHA-1 are cryptographically broken for collision resistance — never use them to verify security properties — but are still common for legacy compatibility and non-security checksums (e.g. cache keys, ETags). SHA-384 is rarely seen outside TLS/certificate contexts.
Is my file or text uploaded to a server?
No. All hashing runs entirely in your browser using the Web Crypto API (for SHA algorithms) and a pure-JavaScript MD5 implementation. Your file bytes and text never leave your device. The tool works completely offline once the page has loaded.
What is HMAC?
HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to produce a signature. Unlike a plain hash, HMAC can only be reproduced by someone who knows the secret key. APIs like Stripe, Slack, and GitHub use HMAC-SHA256 to sign webhook payloads so your server can verify a request genuinely came from them.
How do I verify a file checksum from a download page?
Go to the File & Verify tab, drop the downloaded file onto the drop zone, then paste the expected hash from the publisher's download page into the "Verify" field. The tool auto-detects the algorithm from the hash length (32 chars = MD5, 40 = SHA-1, 64 = SHA-256, 96 = SHA-384, 128 = SHA-512) and immediately shows whether the hashes match.
What is the checksums.sha256 download format?
When you hash multiple files in batch mode, the "Download checksums.sha256" button creates a text file in the standard sha256sum format: one line per file, with the hex hash followed by two spaces and the filename. Any Linux or macOS terminal can verify the batch with the command: sha256sum -c checksums.sha256
More Productivity Tools
Explore our other privacy-focused tools designed to boost your productivity
JSON Formatter & Validator
Format, validate, and explore JSON & XML in your browser — tree view, table view, sort keys, no uploads
UTM Link Builder
Build UTM-tagged campaign URLs instantly — source, medium, campaign presets, custom params, one-click copy. No uploads.
Unix Timestamp Converter
Decode Unix timestamps with auto-precision detection, scan text for embedded timestamps, and convert dates to epoch — no uploads