Hash Generator

What does this hash generator do?

It turns any text or file into a fixed-length fingerprint, and then answers the question you actually came with: is this download the same file the site published, or not?

• All five algorithms at once: MD5, SHA-1, SHA-256, SHA-384 and SHA-512, side by side, with no page to switch between.
• Checksum verification with a plain match or no match, in words, not in two strings you have to compare character by character.
• Paste the whole SHA256SUMS block and we find the line for your file.
• No algorithm to choose: we read it from the length of the hash you paste.
• The ready-made terminal command for Windows, macOS and Linux, with your file name already in it.
• Compare two files directly against each other, when nobody published a hash at all.
• HMAC with a secret key, for checking a webhook signature.
• hex, HEX and Base64 output, because different projects publish different formats.

Everything runs in your browser. Your file is never uploaded, and there is no server here that could store it even if we wanted to.

How do I check a file I just downloaded?

Open the File tab and drop the file in. It stays on your machine, and the five hashes appear one after another as they finish.

Paste what the site gave you into the expected hash field. A single hash works. So does the entire SHA256SUMS file, pasted raw, with every line in it.

Read the answer. Green means the file is intact. Red means stop and download it again.

You never pick an algorithm. A hash 32 characters long is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512, so we work it out from what you paste.

Why pasting the whole checksum block matters

Real projects do not hand you one hash. They publish a single file listing everything they released:

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 *ubuntu-24.04-desktop-amd64.iso
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad  ubuntu-24.04-live-server-amd64.iso

Ubuntu, Debian, Arch, Blender, VeraCrypt and most Linux mirrors all work this way. Every other tool asks you for one hash, so you end up squinting at a wall of 64-character strings trying to find your row, and a mis-copied row is exactly how a wrong answer happens.

Paste the whole block here. We read every line, match it against the name of the file you dropped, and use the right one. The BSD format, SHA256 (file) = hash, is understood too, and a GPG-signed block with headers and a signature around it is fine: the noise is ignored.

What a checksum proves, and what it does not

A checksum proves integrity, not authenticity. A match means not one byte changed between the server and your disk. It does not tell you the file is safe, or that the person who published it is who they claim to be.

The reason is simple: whoever can replace a download can usually replace the hash printed next to it. That is why serious projects sign their checksum file with GPG. The signature proves who wrote the list; the checksum then proves the file matches the list.

So use a checksum for what it is good at: catching a truncated download, a corrupted disk, a bad mirror, a transfer that silently failed. For "is this publisher real", you need a signature or an official HTTPS source, not a hash.

Is MD5 broken? Yes and no

MD5 and SHA-1 are broken for security and fine for integrity, and the difference is worth understanding.

Broken here means someone can deliberately construct two different files that produce the same hash. That destroys MD5 for anything where an attacker is involved: signatures, certificates, proving a file was not tampered with.

It does nothing to the everyday case. A download that got cut off at 90% will not accidentally produce a matching MD5, and random corruption never will. That is why a lot of older software still publishes MD5, and why we still calculate it: you need it to check against what was actually published.

For anything new, use SHA-256.

Hashing is not encryption

A hash cannot be reversed. It is not encryption with a lost key, it is a one-way function that throws information away: a 4GB file and a single letter both come out as 64 characters, so most of the input is simply gone.

Sites that claim to "decrypt" a hash are doing something else. They hashed millions of common passwords in advance and look yours up in that list. If your input was 123456, it is in the list. If it was a file, it never will be.

This tool has no lookup and never will. Reversing hashes is the business of cracking passwords, and that is not what we build.

What this tool does not do

• It does not reverse or crack hashes. There is no lookup, no dictionary, no "decrypt" button, and that is a deliberate line we do not cross.
• It does not handle files over 1 GB in the browser. Hashing needs the whole file in memory, and a tab that eats 4 GB of RAM crashes. Above the limit we give you the exact terminal command instead, which is faster anyway.
• It does not do HMAC-MD5. The browser's own crypto engine does not offer it, and we would rather say so than ship a hand-rolled version of a broken algorithm.
• It does not do bcrypt, scrypt or Argon2. Those are password hashes, deliberately slow and salted, and they belong on your server, never in a web page.
• It does not verify a GPG signature. It checks that a file matches a hash. Proving who published that hash is a different job and needs a different tool.

Who uses this

• Anyone who just downloaded something big and saw a long code next to the button, wondering what to do with it.
• Developers checking a release artefact, a container image digest or a build output before shipping it.
• Sysadmins confirming an ISO before writing it to a USB stick and installing on real hardware.
• Backend developers validating a webhook signature from Stripe, GitHub, Slack or Shopify with HMAC.
• Anyone with two copies of a file and no idea whether they are the same, which the compare tab answers in one drop.