Hash Generator
Generate MD5, SHA-1, SHA-2, SHA-3, Keccak-256 and CRC32 hashes or HMACs of text or files, and check a known value.
Three steps, no reading required.
Paste your input
Drop text, code, or data into the input pane — from an API response, a file, anywhere.
Pick a mode
Toggle the modes above the output. The result updates instantly as you type.
Copy the result
Grab the output with Copy, or fix the error shown if the input is invalid.
Try it with a sample.
DevUtilsNow
Hash it on our server
- Uploads the text you are hashing, often a secret
- Offers MD5 with no warning it is broken for security
- Often hides the algorithm choice
Computed in your tab
- MD5, SHA-1, SHA-256, SHA-384 and SHA-512, each with its own copy button
- Nothing is uploaded or stored
- Tells you MD5 and SHA-1 are for checksums, not security
Questions worth answering upfront.
No. Hashes are computed entirely in your browser using the Web Crypto API. Nothing you enter is uploaded or stored.
MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-384, SHA3-512, Keccak-256 and the CRC32 checksum, all shown at once with a copy button for each. The SHA-2 family uses the browser's native Web Crypto API. Tick Uppercase hex if you need capital letters.
Yes. Click Open file to hash any file in your browser, then paste the published checksum into Compare with. The tool tells you which algorithm matches, or that none do. Text is hashed as UTF-8 bytes.
No. MD5 and SHA-1 are broken for security purposes and should only be used for checksums or non-security use cases. Use SHA-256 or SHA-512 for anything security-related.
No. Hashing is one-way by design. This tool generates hashes; it cannot recover the original input from a hash.
Switch to HMAC, enter the secret key and choose whether it is text, hex or Base64. You get HMAC-MD5, HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, HMAC-SHA512 and HMAC-SHA3 at once, for example to check a webhook signature. The key is never saved or uploaded.
Both use the Keccak algorithm, but SHA-3 (FIPS 202) pads the input differently, so the outputs differ. Keccak-256 is the original version that Ethereum uses for addresses and signatures; use SHA3-256 everywhere else.
CRC32 is a fast 32-bit checksum used by zip, gzip and PNG to detect accidental corruption. It is not secure: anyone can create a different input with the same CRC32, so use SHA-256 to verify downloads against tampering.
People who use this also reach for
Guides that pair with this tool
MD5, SHA-1 & SHA-256: Hashing Explained
What a hash function is, how MD5, SHA-1, SHA-256, SHA-512 and SHA-3 differ, what HMAC and CRC32 are for, and why hashing is not encryption.
Need another tool?
36+ browser-based utilities — all free, all private, nothing to install.