About Hash Generator
This free hash generator turns any text or file into a fixed-length fingerprint using MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 or CRC32. It needs no sign-up and runs in your browser, so the text or file you hash is never uploaded.
A hash function reads input of any size and produces a short digest. The same input always gives the same digest, a one-character change gives a completely different one, and there is no practical way to work backwards from the digest to the input. That makes hashes useful for checking that a download is intact, comparing two files without opening them, and signing messages with a shared key.
Pick an algorithm, type or paste text (or switch to File and choose one), and the digest appears at once. You can show it in lowercase hex, uppercase hex or Base64, turn on HMAC and type a secret key, and paste an expected hash to see whether it matches. The SHA-1, SHA-256, SHA-384 and SHA-512 digests come from the Web Crypto API built into your browser. MD5, SHA-224, SHA3-256, SHA3-512 and CRC32 are computed by code on this page, checked against the published test vectors.
A hash is not encryption. You cannot decrypt it, and a hash alone is the wrong tool for storing passwords. MD5 and SHA-1 are broken for security use, and the tool says so when you select them.
How to use Hash Generator
- Choose an algorithm from the row of buttons: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 or CRC32. SHA-256 is a good default.
- Choose Text and type or paste your input, or choose File and pick a file from your device. The hash updates as you type.
- Read the digest in the result box. Tick Uppercase for capital hex letters, or Base64 output to show the digest in Base64 instead of hex.
- For a keyed hash, tick HMAC with secret key and enter the key. The result is then labelled HMAC-SHA-256 (or whichever algorithm you chose).
- To verify a download or a value from documentation, paste the expected hash into Compare with a known hash. The tool says Match or No match.
- Use Copy to put the digest on your clipboard.
Features
- Nine algorithms: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 and CRC32.
- Hashes text as UTF-8, so accented letters, other scripts and emoji hash the same way as on a server or in a command-line tool.
- Hashes a file you choose from your device. The file is read in your browser and never uploaded.
- HMAC with a secret key for every algorithm except CRC32, following RFC 2104.
- Hex output in lowercase or uppercase, or Base64 output.
- Compare with a known hash. Case, spaces and a leading 0x are ignored, and the expected value can be hex or Base64.
- SHA-1, SHA-256, SHA-384 and SHA-512 use the Web Crypto API in your browser, which is fast and well tested.
- A warning appears when you pick MD5, SHA-1 or CRC32, because they are not safe for security purposes.
- One-click copy of the result.
Worked examples
SHA-256 of "abc" gives ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
The standard test vector from FIPS 180. Any correct SHA-256 tool gives this value.
SHA-256 of "Hello, World!" gives dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f
Capital H, comma, space and the exclamation mark all matter. Remove the exclamation mark and the whole digest changes.
SHA-256 of an empty input, read from a file gives e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Every empty file has this SHA-256. If a download of the wrong size shows it, the file is empty.
HMAC-SHA-256, key "key", message "The quick brown fox jumps over the lazy dog" gives f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
A widely published HMAC test vector. The key is read as plain text.
SHA-256 of "abc" with Base64 output gives ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0=
The same 32 bytes as the hex digest above, written in Base64. It is 44 characters long.
CRC32 of "123456789" gives cbf43926
The standard CRC-32 check value, used by ZIP, PNG and Ethernet.
Algorithms in this tool
| Algorithm | Output | Hex length | Status |
|---|---|---|---|
| MD5 | 128 bits | 32 | Broken. Collisions are cheap. Checksums only. |
| SHA-1 | 160 bits | 40 | Broken for signatures and certificates. Avoid for new work. |
| SHA-224 | 224 bits | 56 | Secure. A shortened SHA-2 variant. |
| SHA-256 | 256 bits | 64 | Secure. The usual default. |
| SHA-384 | 384 bits | 96 | Secure. A shortened SHA-512 variant. |
| SHA-512 | 512 bits | 128 | Secure. Often fast on 64-bit processors. |
| SHA3-256 | 256 bits | 64 | Secure. Different design from SHA-2, no length-extension weakness. |
| SHA3-512 | 512 bits | 128 | Secure. Different design from SHA-2. |
| CRC32 | 32 bits | 8 | Detects accidental errors only. Not a security hash. |
The digest of "abc" in every algorithm
| Algorithm | Digest of "abc" |
|---|---|
| MD5 | 900150983cd24fb0d6963f7d28e17f72 |
| SHA-1 | a9993e364706816aba3e25717850c26c9cd0d89d |
| SHA-224 | 23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7 |
| SHA-256 | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
| SHA-384 | cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7 |
| SHA-512 | ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f |
| SHA3-256 | 3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532 |
| SHA3-512 | b751850b1a57168a5693cd924b6b096e08f621827444f70d884f5d0240d2712e10e116e9192af3c91a7ec57647e3934057340b4cf408d5a56592f8274eec53f0 |
| CRC32 | 352441c2 |
Good to know
Which algorithm should you use?
For anything where an attacker could matter, such as signatures, integrity checks of software you distribute or tokens, use SHA-256, SHA-512 or SHA-3. For quick comparisons where nobody is trying to fool you, such as checking that a copy of a file matches the original, MD5 and CRC32 are still fine and are often what a download page publishes.
SHA-256 and SHA-512 belong to the same SHA-2 family and are built the same way. SHA-3 is a separate design, standardised in 2015, and is not affected by the length-extension trick that applies to plain SHA-2. That trick is one reason HMAC exists.
Hashes are not for storing passwords
A fast hash such as SHA-256 lets an attacker try billions of guesses per second on a stolen database. Password storage needs a deliberately slow, salted algorithm such as bcrypt or Argon2. This tool does not provide either of them. Use it for checksums, fingerprints and HMAC, not for password hashing.
Why a hash will not match
The usual causes are an extra newline or space at the end of the text, a different line ending (Windows uses two characters, Linux one), a different text encoding, or a file that was changed in transfer. This tool hashes the exact characters in the box as UTF-8. When you compare with a command-line tool, make sure it is hashing the same bytes, for example by using printf instead of echo, which adds a newline.
Privacy: how it works
- The text, the file and the HMAC key stay in your browser tab. Nothing is sent to Ulkaa or to any other server, which you can confirm in the Network tab of your browser developer tools.
- Because the work happens on your own device, large files are limited by your browser memory rather than by an upload limit.
Tips
- To verify a download, choose File, pick the downloaded file, and paste the publisher hash into the compare box. A match means the bytes are identical to what the publisher hashed.
- Hash the same text twice with a trailing space added once. Seeing two unrelated digests is the quickest way to understand the avalanche effect.
- A hash you found on the same page as the download only protects against corruption. It cannot protect you if the page itself was altered.
- HMAC takes the key as plain text. If your key is hex or Base64, decode it first, or the result will not match another system.
Frequently asked questions
Is it really free?
Yes. There is no price, no trial and no credit card. Ulkaa Tool does the work with your own device, so there is no server bill to pass on to you.
Do I need an account?
No. There is no sign-up and no login. Open the page and use it. An Ulkaa account is not needed for anything on this tool.
Does it run in my browser?
Yes. Your text and files are processed by code running in your browser tab, on your own device.
Is my data uploaded?
No. Your text and files are never sent to Ulkaa or to anyone else. You can check this yourself by watching the Network tab in your browser developer tools while you use the tool.
What is a hash?
A hash is a short, fixed-length value computed from data of any size. The same data always gives the same hash and a tiny change gives a very different one. It identifies data without revealing it.
Can a hash be reversed or decrypted?
No. A hash function discards information, so there is nothing to decrypt. Sites that appear to reverse hashes only look the value up in a list of known inputs, which works for common words and short strings.
Is MD5 secure?
No. Researchers produced MD5 collisions in 2004, and making two different files with the same MD5 is now cheap. It is still fine as a checksum to detect accidental corruption, but not for signatures, certificates or passwords.
Is SHA-1 still safe?
Not for security. The first public SHA-1 collision was shown in 2017 and later attacks made it cheaper. NIST plans to retire it by 2030. Use SHA-256 or SHA-3 for new work.
How do I get the SHA-256 hash of a file?
Choose SHA-256, switch the input to File and pick the file. The digest appears when the file has been read. Paste the publisher value in the compare box to check it. The file is not uploaded.
What is the difference between SHA-256 and SHA-512?
Both are in the SHA-2 family. SHA-256 gives a 256-bit digest (64 hex characters) and SHA-512 gives a 512-bit digest (128 hex characters). Both are secure today. SHA-512 can be faster on 64-bit processors.
What is HMAC?
HMAC mixes a secret key into a hash so that only someone with the key can produce or check the result. It is used to sign API requests and webhooks. Tick HMAC with secret key and enter the key to compute it.
Why is my hash different from another tool?
The input bytes differ. Look for a trailing newline, different line endings, a different encoding, or a leading or trailing space. This tool hashes the exact text you entered as UTF-8.
Does this tool offer bcrypt or RIPEMD-160?
No. It covers MD5, SHA-1, SHA-2, SHA-3 and CRC32, plus HMAC. For password storage use a dedicated slow hash such as bcrypt or Argon2 in your own application.
Popular Hash Generator pages
- MD5 Hash GeneratorGet the 128-bit MD5 hash of text or a file as 32 hexadecimal characters.
- SHA-1 Hash GeneratorGet the 160-bit SHA-1 hash of text or a file as 40 hexadecimal characters.
- SHA-224 Hash GeneratorGet the 224-bit SHA-224 hash of text or a file as 56 hexadecimal characters.
- SHA-256 Hash GeneratorGet the 256-bit SHA-256 hash of text or a file as 64 hexadecimal characters.
- SHA-384 Hash GeneratorGet the 384-bit SHA-384 hash of text or a file as 96 hexadecimal characters.
- SHA-512 Hash GeneratorGet the 512-bit SHA-512 hash of text or a file as 128 hexadecimal characters.
- SHA3-256 Hash GeneratorGet the 256-bit SHA3-256 hash of text or a file as 64 hexadecimal characters.
- SHA3-512 Hash GeneratorGet the 512-bit SHA3-512 hash of text or a file as 128 hexadecimal characters.
- CRC32 Checksum CalculatorCalculate the 32-bit CRC32 checksum of text or a file as 8 hexadecimal characters.
- HMAC-SHA256 GeneratorSign a message with a secret key using HMAC-SHA256 and read the result as hex or Base64.
- File Checksum CalculatorHash a file on your device and compare it with the checksum the publisher gave you.