Hash Generator (MD5, SHA-256 & more)
Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files at once, with optional HMAC. Files are read and hashed on your device.
Last updated
Text to hash
Hashes
Start typing to see hashes
Keyboard shortcuts:Ctrl ↵Copy all hashesCtrl SDownloadCtrl KSearch tools
How to use the Hash Generator
Choose text or file
Type text to hash, or switch to File and drop in any file up to 200 MB.
Get every hash at once
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are calculated together, live.
Adjust the output
Pick hex or Base64, toggle uppercase, or turn on HMAC and enter a secret key.
Compare checksums
Paste an expected hash into Compare to see instantly which algorithm matches.
Features
- Five algorithms at once: MD5, SHA-1, SHA-256, SHA-384 and SHA-512
- Hash text as you type, or any file up to 200 MB (drag and drop, or choose a file)
- Hex output in lowercase or uppercase, or Base64 output
- HMAC mode with a secret key, for all five algorithms
- A Compare box that highlights which algorithm matches an expected hash
- MD5 and SHA-1 clearly labelled as not suitable for security
- Copy all hashes or download them as a text file — also with Ctrl/Cmd + Enter and Ctrl/Cmd + S
Are my files uploaded?
No. Files are read with your browser's File API and hashed on your device. SHA algorithms use the browser's built-in Web Crypto API, and MD5 and HMAC are calculated by DevNest's own JavaScript in the page. The file, the text and your HMAC key aren't sent to a server.
Examples
SHA-256 of text
The same input always produces the same hash.
Text
helloSHA-256
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824MD5 checksum
Still common for checksums — but not suitable for security.
Text
helloMD5
5d41402abc4b2a76b9719d911017c592HMAC-SHA256 signature
The kind of signature many services use for webhooks. Loads with HMAC on and the key set.
Message · key
The quick brown fox jumps over the lazy dog key: keyHMAC-SHA256
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
Understanding hashing
What is hashing?
A cryptographic hash function turns input of any size into a fixed-size fingerprint called a digest. The same input always gives the same hash; changing even one character gives a completely different hash; and you can't work backwards from a hash to the original input.
SHA-256("hello") = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("Hello") = 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969MD5 vs SHA-1 vs SHA-256 vs SHA-512
| Algorithm | Output | Security status | Typical use today |
|---|---|---|---|
| MD5 | 128 bits (32 hex) | Broken — practical collisions | Non-security checksums, legacy systems |
| SHA-1 | 160 bits (40 hex) | Broken for collision resistance | Legacy systems and older protocols |
| SHA-256 | 256 bits (64 hex) | Secure | File integrity, signatures, HMAC |
| SHA-384 | 384 bits (96 hex) | Secure | TLS and higher security margins |
| SHA-512 | 512 bits (128 hex) | Secure | Integrity checks; often fast on 64-bit CPUs |
MD5 and SHA-1 are considered weak for security purposes because attackers can create two different inputs with the same hash. They're still fine for spotting accidental corruption, but use SHA-256 or stronger for anything security-related.
Hashing vs encryption
Encryption is reversible: with the right key you get the original data back. Hashing is one-way. That's why passwords should be hashed, not encrypted — but not with MD5 or SHA-256 alone. Those are designed to be fast, which makes them easy to brute-force. Store passwords with a slow, salted password hashing algorithm such as Argon2id, bcrypt or scrypt.
Hashing files and comparing checksums
Software publishers often list a SHA-256 checksum next to their downloads. To verify a file, switch to File, drop in the download, and paste the published checksum into the Compare box. If it matches, the file is identical to the one the publisher hashed. A checksum only proves integrity if you got it from a trusted source, such as the official website over HTTPS.
Text is hashed as UTF-8 exactly as typed, so a trailing newline, an extra space or Windows line endings will change the result.
HMAC
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a hash function with a secret key, so only someone who knows the key can produce the same result. Services commonly sign webhooks and API requests with HMAC-SHA256. Turn on HMAC and enter your key to calculate HMAC-MD5 through HMAC-SHA512 at once.
The key is used as UTF-8 text. If your key is written in hex or Base64, DevNest uses those characters literally rather than decoding them to bytes first.
Frequently asked questions
Which hash algorithm should I use?
Use SHA-256 or SHA-512 for anything security-related. Use MD5 or SHA-1 only for non-security checksums or when an older system requires them.
Why doesn't my hash match the one from another tool?
The input bytes are almost always different: a trailing newline, Windows line endings, extra spaces or a different text encoding. DevNest hashes text exactly as typed, encoded as UTF-8.
Is there a file size limit?
Yes, files up to 200 MB are supported, because the whole file is loaded into your browser's memory to be hashed.
Can a hash be reversed?
No. Hash functions are one-way. Weak or unsalted hashes of common inputs can sometimes be found by guessing, which is why passwords need a dedicated password hashing algorithm.
Should I hash passwords with SHA-256?
No. General-purpose hashes are designed to be fast, which makes them easy to brute-force. Store passwords with Argon2id, bcrypt or scrypt instead.