About the SHA Generator
A SHA hash is a fixed-length fingerprint of data. Change a single character or a single byte of a file, and the fingerprint changes completely. That makes SHA hashes the standard way to check that a download arrived intact, to spot changed files, and to build signatures and tokens.
The SHA Generator calculates SHA-1, SHA-256, SHA-384 and SHA-512 at the same time, for text you type or for a file up to 500 MB. Paste the checksum from a download page into the compare box and the tool tells you which algorithm matches, even if you paste a whole line from a checksum file.
Add a key to get an HMAC instead, the keyed hash used to sign webhooks and API requests. Output comes in lowercase hex, uppercase hex or Base64. Hashing uses your browser's built-in Web Crypto engine, so files and text never leave your device.
How to use it
- Choose Text or FileText hashes what you type, as UTF-8. File hashes the exact bytes of a file you drop or choose, up to 500 MB.
- Add your inputType or paste text, or drop a file on the drop zone. All four hashes appear as soon as the input is ready.
- Add an HMAC key if you need oneFor text, enter a key in "HMAC key" to get HMAC-SHA hashes instead of plain ones. Leave it empty for normal hashes.
- Pick the output formatChoose lowercase hex (the most common), uppercase hex, or Base64, which some APIs and the Subresource Integrity attribute use.
- Verify a checksumPaste the expected hash into "Compare with an expected hash". The matching algorithm is highlighted, or you see that nothing matches.
Key features
Four algorithms at once
SHA-1 (160-bit), SHA-256 (256-bit), SHA-384 (384-bit) and SHA-512 (512-bit), side by side, each with its own copy button.
Large files
Hash ISO images, installers and archives up to 500 MB, read and hashed on your device.
HMAC
Enter a key to compute HMAC-SHA1, HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512, as used by webhooks and signed API requests.
Flexible checksum compare
Paste a bare hash, an uppercase hash, a "sha256:" value, or a whole line such as "hash file.iso". Hex and Base64 both work.
Hex or Base64
Switch the output between lowercase hex, uppercase hex and Base64 without hashing again.
Private by design
Hashing happens in your browser with Web Crypto. Nothing is uploaded.
Examples
Hashing a word
Type hello and the status line reads Hashes calculated ยท 5 B. Two of the results:
SHA-1 aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824These are the same values that sha1sum and sha256sum give on Linux and macOS for the same 5 bytes.
One small change, a completely different hash
Capitalize the first letter, Hello, and the SHA-256 hash has nothing in common with the one above:
185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969A line break counts too. "hello" followed by a new line, which is what echo hello writes, hashes to:
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03Checking a download
Download pages often publish a line like this in a SHA256SUMS file:
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 hello.txtHash the file, paste the whole line into the compare box, and you see Match: it is the SHA-256 hash. These also match: the BSD format SHA256 (hello.txt) = 2cf24d..., an uppercase hash, and a hash with a sha256: prefix. Paste the SHA-1 value instead and it says it is the SHA-1 hash.
HMAC for signing
Type message as the text and secret as the HMAC key. The status line changes to HMAC calculated, and the HMAC-SHA256 is:
8b5f48702995c1598c573db1e21866a9b825d4a794d169d7060a03605796360bThat is the same value as openssl dgst -sha256 -hmac secret gives, which makes the tool useful for checking webhook signatures by hand.
Base64 output
Switch the output to Base64 and the SHA-256 of "hello" becomes:
LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=The bytes are the same, only written differently. Subresource Integrity (integrity="sha256-...") and many APIs use this form.
Tips
- Use SHA-256 unless something specifically asks for another algorithm. It is the default for checksums, certificates, package managers, container images and most APIs.
- When a checksum does not match, download the file again before assuming anything worse. A broken or incomplete download is by far the most common cause.
- To compare text hashes with a command line tool, mind the line break: echo adds one, printf does not. The tool hashes exactly what is in the box.
- For webhook signatures, copy the raw request body exactly as it was sent. Reformatting JSON or changing the line endings changes the HMAC.
- For a quick checksum that matches older software, the MD5 Generator gives MD5 hashes, but prefer SHA-256 for anything new.
Common mistakes and limits
- Using SHA for password storageSHA hashes are designed to be fast, so attackers can test billions of passwords per second against them. Use bcrypt, scrypt or Argon2 for passwords.
- Relying on SHA-1 for securitySHA-1 collisions have been produced in practice. It is fine for spotting accidental changes, but not for signatures or anything an attacker could tamper with.
- Expecting a hash to be decryptedHashing is one-way. You cannot get the text or file back from its hash; you can only hash a candidate and compare.
- Mixing up text and file hashesText is hashed as UTF-8 exactly as typed. The same words saved in a file with a final line break, a byte order mark or Windows line endings give a different hash.
- Trusting a checksum from the same place as the fileIf an attacker can replace the download, they can replace the checksum next to it. Get the checksum from a separate, trusted source, ideally signed.
