UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free hash generator does
A hash turns any amount of data, from one word to a multi-gigabyte file, into a short fixed-length string. It works like a fingerprint: the same data always gives the same hash, and any change, however small, gives a completely different one. That makes hashes the standard way to check that a download is intact, that two files are identical, or that a message has not been altered.
This free online hash generator calculates MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 for text or files at the same time. It can add an HMAC key, switch between hex and Base64 output, hash raw hex or Base64 bytes, and compare the result with a checksum you were given. Everything runs in your browser, so nothing is uploaded.
How to use the hash generator
- Choose Text or Files. For text, type or paste it. For files, drop one or more files onto the box.
- Pick the algorithms. SHA-256 is the best default for checking downloads.
- Read the results. Each hash has a Copy button.
- Compare. Paste the expected hash in the compare box to see a match or no match.
- Save. Download the results in a checksum-style list, or print a summary.
The generator updates as you type, so you can see how one changed character changes every hash.
Hash algorithms compared
| Algorithm | Output | Status | Good for |
|---|---|---|---|
| MD5 | 128 bits, 32 hex characters | Broken for security | Detecting accidental changes, legacy systems |
| SHA-1 | 160 bits, 40 hex characters | Broken for security | Legacy checks such as Git object names |
| SHA-256 | 256 bits, 64 hex characters | Secure | Download checks, signatures, general use |
| SHA-384 | 384 bits, 96 hex characters | Secure | Higher security margin, TLS |
| SHA-512 | 512 bits, 128 hex characters | Secure | Large data, fast on 64-bit CPUs |
| CRC32 | 32 bits, 8 hex characters | Not secure | Error detection in ZIP and network data |
If you do not know which to choose, use SHA-256. It is widely supported, fast and has no known practical attacks.
How to verify a downloaded file
Software publishers often list a checksum next to the download. To check it, hash the file you downloaded using the same algorithm and compare the two values. If they match, the file is exactly the one the publisher hashed. If they differ, the download was corrupted or changed, and you should download it again and not run it.
Take the expected checksum from the publisher's own page, preferably over HTTPS and from a different place than the download link. A checksum on the same page as a tampered file can be tampered with too. For the strongest assurance, also check a digital signature when one is offered.
HMAC and keyed hashes
A plain hash can be created by anyone. An HMAC mixes a secret key into the calculation, so only someone who knows the key can produce or check the value. It is used to sign webhooks, API requests and cookies, and to prove a message came from a trusted sender and was not altered. Enter a key in the HMAC section and the tool computes HMAC with each selected algorithm. Use a long random key, keep it secret, and compare values with a constant-time check in your own code.
Hashing, encryption and password storage
- Hashing is one-way and has no key. It proves data is unchanged.
- Encryption is two-way and uses a key. It hides data and lets the right person read it again.
- Password storage needs a slow, salted hash such as Argon2id, scrypt or bcrypt, because attackers can test billions of fast hashes per second.
Never use a single fast hash such as MD5 or SHA-256 to store passwords. If you need to hide text so it can be read later, use the Text Encryption tool on this site, and to see how guessable a password is, use the Password Strength Checker.
Why hashes do not match
- Different algorithm. Count the characters: 32 is usually MD5, 40 SHA-1, 64 SHA-256.
- Hidden whitespace. A space or new line at the end changes everything.
- Different text encoding. This tool uses UTF-8. Another program may use UTF-16 or a different code page.
- Different line endings. Windows and Unix files differ in how a new line is stored.
- Case. Hex is not case sensitive, but Base64 is.
- A changed or damaged file.
Everyday uses for hashes
Developers use hashes to name content, to find duplicate files, to cache results and to sign requests. Administrators use them to check that backups and downloads are intact and to monitor files for unexpected changes. Investigators use them to show that a copy of evidence is identical to the original. Version control systems build entire histories out of them. Teachers use them to show how a tiny change spreads through a result, which is called the avalanche effect.
Checking hashes from the command line
You can reproduce every result on this page with tools already on your computer, which is a good way to confirm a download.
| System | Command for SHA-256 |
|---|---|
| Linux | sha256sum file.iso |
| macOS | shasum -a 256 file.iso |
| Windows PowerShell | Get-FileHash file.iso -Algorithm SHA256 |
| Windows Command Prompt | certutil -hashfile file.iso SHA256 |
Replace SHA256 with MD5 or SHA512 for other algorithms. The Download results button saves a list in the same layout as checksum files, so a later sha256sum -c can verify them.
Collisions, preimages and why old hashes are retired
Security experts judge a hash by three properties. Preimage resistance means you cannot find an input for a given hash. Second-preimage resistance means you cannot find another input with the same hash as a given one. Collision resistance means you cannot find any two inputs with the same hash. MD5 and SHA-1 have lost collision resistance, since researchers have produced two different files with the same hash. That is why certificates, signatures and software releases moved to the SHA-2 family. Collisions do not make old hashes useless for spotting accidental damage, but they stop them from proving that a file was not altered on purpose.
Privacy, limits and responsible use
MD5 and the SHA family are calculated with built-in browser functions and a small local MD5 routine, with no upload. Files up to 1 GB are read into memory, so very large files may be slow or fail on small devices. Hashes do not prove who made a file, only that it matches. Check the source of any expected value, and use a digital signature where it matters.
Frequently asked questions
What is a hash?
A hash is a fixed-length fingerprint of data. The same input always gives the same hash, and even a tiny change gives a completely different one.
How do I generate a hash for free?
Choose Text or Files, enter your data, pick the algorithms and read the results. Copy any hash with its button or copy them all.
Is my file uploaded?
No. Hashing runs in your browser, so text and files stay on your device.
How do I verify a download with SHA-256?
Hash the file here, then paste the checksum the publisher gave you into the compare box. A match means the file is identical to the one they hashed.
What is the difference between MD5, SHA-1 and SHA-256?
They are different algorithms with different output lengths: 128, 160 and 256 bits. MD5 and SHA-1 are broken against deliberate attacks, while SHA-256 is currently considered secure.
Is MD5 safe?
Not for security. It is still used to detect accidental corruption and for non-security IDs, but attackers can create two different files with the same MD5.
Can a hash be reversed?
No. A hash is one-way. People recover simple inputs by guessing and comparing hashes, which is why short or common values are not safe to hash alone.
Is hashing the same as encryption?
No. Encryption can be undone with a key. A hash cannot be undone and has no key. Use the Text Encryption tool on this site when you need to get the data back.
Should I hash passwords with SHA-256?
No. Fast hashes make guessing cheap. Use a slow, salted password hash such as Argon2id, scrypt or bcrypt.
What is HMAC?
HMAC mixes a secret key into the hash so that only someone with the key can create or check it. It is used to sign messages and API requests.
Why does my hash not match?
Common causes are a different algorithm, a hidden line break or space at the end of the text, different text encoding, a different case, or a file that was changed or damaged.
Does a line break change the hash?
Yes. Hello and Hello followed by a new line have different hashes. Use the option to ignore one line break at the end to match tools that add or remove it.
What is CRC32?
A short checksum that detects accidental errors, such as in ZIP files. It is not secure and many different inputs share the same value.
How big a file can I hash?
Files up to 1 GB, depending on your device memory. For larger files use a command-line tool such as sha256sum.
Can I hash hex or Base64 data?
Yes. Switch the input type to Hex or Base64 and the tool hashes the raw bytes.
What does the Download results file contain?
One line per hash in the form hash, two spaces, name, and the algorithm in brackets. The print summary lists the same results.
Is this hash generator free?
Yes. It is free online with no sign-up and no limits.
Sources and further reading
- NIST FIPS 180-4, Secure Hash Standard (nist.gov), for SHA-1 and the SHA-2 family.
- RFC 1321, The MD5 Message-Digest Algorithm, and RFC 2104, HMAC (rfc-editor.org).
- NIST SP 800-107, Recommendation for applications using approved hash algorithms.
- OWASP Password Storage Cheat Sheet (owasp.org).
- Stevens et al., The first collision for full SHA-1 (shattered.io).
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.