What is a hash?
A hash function turns data of any length into a fixed-length "fingerprint". The same input always gives the same result, changing a single character changes the result completely, and the original cannot be recovered from the hash. Hashes are used to verify downloads, detect changes to data and build cache keys.
How to use
- Pick an algorithm, or "All algorithms" to calculate every result at once.
- Type in the Input box. With "Auto update" on, the result appears as soon as you stop typing.
- Adjust the input encoding and output encoding if needed, or enable HMAC and enter a key.
Algorithm comparison
| Algorithm | Length (hex) | Suitable for |
|---|---|---|
| MD5 | 32 characters | Checksums and cache keys; broken, never use it for security |
| SHA-1 | 40 characters | Compatibility with older systems (such as Git); not recommended for security |
| SHA-256 | 64 characters | The most widely used choice today |
| SHA-384 / SHA-512 | 96 / 128 characters | When a longer result is required |
What is HMAC?
HMAC is a hash combined with a secret key: only someone who knows the key can produce the same result. Many services use it to sign API requests and to prove that a webhook really came from them; payment providers, GitHub and LINE all use HMAC-SHA256. Enable HMAC and enter the key; the key can be plain text, Hex or Base64.
Input and output encoding
- Input encoding: the same text produces different bytes in different encodings, and therefore a different hash. UTF-8 is the usual choice. Hex or Base64 input means the hash is calculated over the raw bytes they represent.
- Output encoding: Hex (lowercase or uppercase) or Base64. Many API signatures expect Base64.
Examples
- MD5 of
abc:900150983cd24fb0d6963f7d28e17f72 - SHA-256 of
abc:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad - HMAC-SHA256 with key
keyand messageThe quick brown fox jumps over the lazy dog:f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
File hashes and comparison
- File hash: drag a file onto the input area or click "Choose file" (up to 200 MB). The hash is calculated from the file content, which is how you check that a download is complete.
- Compare: paste the hash published by the download site into "Compare with expected hash" to see whether it matches; Hex is not case-sensitive. With "All algorithms", it tells you which algorithm matches.
FAQ
Can a hash be decrypted?
No. Hashing is one-way, so there is nothing to decrypt. So-called "MD5 decrypters" simply look the hash up in huge tables of precomputed common strings, which is why simple passwords are easy to find.
Why is my result different from another tool's?
The input is usually slightly different: an extra space or line break, different line endings (Windows CRLF vs Unix LF) or a different text encoding. Make sure the input is identical and the same input encoding is used.
Should I store user passwords with MD5 or SHA-256?
No. These algorithms are fast, so attackers can try guesses quickly too. Use a password hashing algorithm such as bcrypt, scrypt or Argon2.
Is my HMAC key stored?
No. Calculations run in your browser. The site remembers your input and settings, but the HMAC key is deliberately never remembered, so you need to enter it again after reloading.