MD5, SHA-1 and SHA-256 hash generator

A hash function turns any input into a fixed-size fingerprint. The same input always gives the same hash, and changing a single bit changes about half of the output. The algorithms differ in output size and in how hard it is to find two inputs with the same hash (a collision).

None of these are for passwords. They are built to be fast, which lets an attacker try billions of guesses per second. Store passwords with a slow, salted function such as bcrypt or Argon2: the bcrypt generator explains how.

Projects publish a SHA-256 (sometimes MD5 or SHA-512) next to each download so you can check the file arrived intact and unmodified. Drop the file in the Files tab, paste the published checksum into Compare with a checksum, and the tool says which algorithm and file it matches. It accepts a bare hash, a sha256sum line, or the BSD form SHA256 (file) = ....

In a terminal:

# Linux
sha256sum ubuntu.iso
sha256sum -c SHA256SUMS          # check every file listed in a checksum file

# macOS
shasum -a 256 ubuntu.iso
md5 ubuntu.iso

# Windows PowerShell (SHA-256 by default)
Get-FileHash .\ubuntu.iso
Get-FileHash .\ubuntu.iso -Algorithm MD5

# Windows cmd
certutil -hashfile ubuntu.iso SHA256

With several files dropped, the tool also builds a SHA256SUMS file in the exact format sha256sum -c reads, so you can publish checksums for your own releases.

Browser JavaScript has SHA-1 and SHA-2 built in through Web Crypto (secure contexts only, so HTTPS or localhost). There is no MD5 in Web Crypto; use a library such as js-md5.

const bytes = new TextEncoder().encode('hello');
const buf = await crypto.subtle.digest('SHA-256', bytes);
const hex = [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, '0')).join('');
// 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Node.js

import { createHash, createHmac } from 'node:crypto';
createHash('md5').update('hello').digest('hex');      // 5d41402abc4b2a76b9719d911017c592
createHash('sha256').update('hello').digest('base64');
createHmac('sha256', secret).update(body).digest('hex'); // webhook signatures

Python

import hashlib, hmac
hashlib.md5(b'hello').hexdigest()
hashlib.sha256('héllo'.encode('utf-8')).hexdigest()
with open('big.iso', 'rb') as f:
    hashlib.file_digest(f, 'sha256').hexdigest()   # Python 3.11+
hmac.new(secret, body, 'sha256').hexdigest()

Go

sum := sha256.Sum256([]byte("hello"))
fmt.Printf("%x\n", sum)
fmt.Printf("%x\n", md5.Sum([]byte("hello")))

Shell. Watch the newline: echo adds one, so echo hello | md5sum hashes six bytes, not five.

printf '%s' hello | sha256sum   # 2cf24dba...  (no newline)
echo -n hello | md5sum          # 5d41402a...
echo hello | md5sum             # b1946ac9...  (hashes "hello\n")

A hash is exact: any difference in the input bytes gives a completely different result. When hashes disagree, check these first.

A plain hash proves nothing about who made it: anyone can hash a modified message. HMAC (RFC 2104) runs the hash twice with a secret key mixed in, so only holders of the key can create a valid tag. It is how APIs sign webhooks. GitHub sends X-Hub-Signature-256: sha256=<hex>, an HMAC-SHA256 of the raw request body with your webhook secret.

To debug a signature, paste the exact raw body into the tool, turn on HMAC with a key, enter the secret, and compare the HMAC-SHA256 row with the header. If it differs, the body was probably re-serialized (parsed and turned back into JSON) before hashing. In code, compare signatures with a constant-time function such as crypto.timingSafeEqual or Python's hmac.compare_digest.

More security tools for developers are listed in security tools on DevHunt. For encoding rather than hashing, see the Base64 encoder.