Hash & HMAC Generator (MD5, SHA-256, CRC32)

Getting a digest

1. Leave Hash on Text and type or paste into the box. The digest appears at the top, grouped in eights, with no button press, and the line under the box counts the bytes that went in.
2. Pick the algorithm card. SHA-256 is already selected; MD5, CRC32, SHA-1, SHA-384 and SHA-512 sit beside it.
3. Verifying a download instead? Switch Hash to File and drop the file in. The line under it names the file and its size.
4. For a keyed HMAC, put the shared secret in the HMAC key field. The digest's label changes to what is being computed, for example HMAC-SHA-256.
5. Paste the published checksum into Expected checksum if you have one, then take the digest with Copy.

About this tool

A hash generator turns whatever you give it into a fixed-length fingerprint, and there are six to pick from here: MD5, CRC32, SHA-1, SHA-256, SHA-384 and SHA-512. Choose one of the six cards under Algorithm, each marked with its length and what it is fit for, and the hex updates as you type, no button involved. SHA-256 is preselected because it is the sane default, and it gives you 64 hex characters. SHA-512 gives 128, SHA-384 gives 96, SHA-1 gives 40, MD5 gives 32, and CRC32 gives 8. You see one algorithm at a time; picking another card re-runs the same input through it.

Most people start on the Text tab. Switch Hash to File and the bytes get read off disk instead, which is how you check a download against the SHA-256 its author published. Paste theirs into Expected checksum and the page says whether it matches, and when it does not, why: a paste of the wrong length is named by the algorithm that length belongs to, and one of the right length is tried again with a trailing newline and with CRLF. The comparison ignores case, spaces and colons, so a value copied out of a SHASUMS file matches one written 3a:7f:b2 style. Put a secret in the HMAC key field and every digest becomes a keyed HMAC instead. CRC32 is the exception, being a plain checksum with no keyed form, and the tool says so rather than failing quietly.

Why your hash doesn't match sha256sum

Type hello into the Text box with SHA-256 selected and you get 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Run echo hello | sha256sum in a terminal and it hands back 5891b5b5… instead. Both are correct.

echo appends a newline, so the shell hashed six bytes and the box hashed five. Use echo -n hello and the two line up exactly. Nearly every mismatch I have chased turned out to be something that small: a trailing newline, CRLF where the other side had LF, or a space that came along with the copy. Paste 5891b5b5… into Expected checksum and the page finds the newline for you.

Good to know

• MD5 and SHA-1 have practical collisions. As bare digests both are fine for spotting a corrupted download and for talking to a system that already expects them, and both are wrong anywhere an attacker gets a say in the input. Keyed, as HMAC-MD5 or HMAC-SHA-1, that warning stops applying, because HMAC does not lean on collision resistance; SHA-256 is still the better pick for anything new.
• A file is read into memory whole before it is hashed, with no streaming. A few hundred megabytes is comfortable on a desktop and can be too much on an older phone.