Hash Generator
Make a hash of any text or file with every common algorithm at once, check a download against its published checksum, sign messages with HMAC, or create and verify bcrypt password hashes. All in your browser: files and text are never uploaded.
- 8 algorithms at once
- Checksum verify
- HMAC and bcrypt
Text
Or drop a file here to hash it (up to 1 GB, never uploaded)
Hashes
Which hash should I use?
- Checking a download: use whichever the publisher gives, usually SHA-256. Paste it into "Compare" and we'll tell you if the file matches.
- MD5 and SHA-1 are broken for security: people can make two different files with the same hash. They're still fine for spotting accidental corruption.
- SHA-256, SHA-512 and SHA-3 are secure for integrity checks and digital signatures.
- HMAC combines a hash with a secret key to prove a message came from someone who knows the key, as used by webhooks and APIs.
- CRC32 is a quick error-detecting checksum (used in ZIP files and networking), not a security hash.
Storing passwords
- Never store passwords with MD5 or SHA, even "salted". They're so fast that a gaming PC tries billions a second.
- Use bcrypt, scrypt or Argon2, which are deliberately slow. In PHP,
password_hash()andpassword_verify()do this for you. - bcrypt cost: each step up doubles the work. 12 is a good default in 2026; aim for a hash to take about a quarter of a second on your server.
- bcrypt only uses the first 72 bytes of a password.
- For Apache or nginx basic authentication, put the ".htpasswd line" in your .htpasswd file.