Hash text or a file with SHA-256, SHA-512, SHA-384, SHA-1 and MD5 at once, as hex or Base64, and verify a published checksum. SHA family uses the browser's Web Crypto API; MD5 uses js-md5. Files up to 500 MB are read in this tab. HMAC-SHA-256 and HMAC-SHA-512 keep the key local. Nothing is transmitted.
SHA-256256-bit · 64 hex
waiting for input
SHA-512512-bit · 128 hex
waiting for input
SHA-384384-bit · 96 hex
waiting for input
SHA-1160-bit · 40 hex
waiting for input
MD5128-bit · 32 hex
waiting for input
Waiting for input15 bytes (UTF-8)·Nothing leaves this tab
A cryptographic hash maps any input (a string, a config file, a 4 GB ISO) to a fixed-length digest that changes completely when a single bit changes. This hash generator computes SHA-256, SHA-512, SHA-384, SHA-1 and MD5 of typed text or of a dropped file, shows each digest as hex or Base64, checks a pasted checksum against the result, and computes HMAC-SHA-256 and HMAC-SHA-512 for keyed authentication. SHA-256 is the default for new integrity checks and signatures; SHA-1 and MD5 are included for matching checksums that older systems still publish.
How the Hash Generator works
Text is encoded as UTF-8; a file is read into memory with the browser's File API. Either way the bytes go to crypto.subtle.digest for the SHA family and to the js-md5 library for MD5, which Web Crypto does not implement. All five digests are computed at once and shown as lowercase hex, uppercase hex or Base64: SHA-256 is always 64 hex characters, SHA-512 128, SHA-384 96, SHA-1 40, MD5 32. Paste a published checksum into Verify: the algorithm is detected from its length, case and surrounding sha256sum text are ignored, and the matching row is marked Match or Mismatch. HMAC imports your key with crypto.subtle.importKey and signs the message locally. There is no upload endpoint; the 500 MB file limit exists only because the whole file is held in memory while hashing.
Limits
Files up to 500 MB, because the whole file is held in memory while hashing.
~/faq
Frequently asked questions
How do I check a file's SHA-256 checksum?
Switch to File, drop the download or click to choose it, then paste the hash from the publisher's page into Verify checksum. The tool detects SHA-256 from the 64-character length and marks the SHA-256 row Match or Mismatch. A match means the bytes on your disk are exactly the bytes the publisher hashed. A mismatch usually means an incomplete download or a different release, and occasionally tampering, so download again from the original source before installing.
Is my file uploaded?
No. The file is read with the browser's File API into this tab's memory and hashed there with Web Crypto. LocalFirstTools has no upload endpoint and the page makes no network request while hashing; open your browser's network tab and drop a file to confirm. The 500 MB limit is a memory budget, not a transfer limit.
Can I decrypt a SHA-256 hash?
No. Hashing is one-way: the digest is 256 bits while the input can be any length, so countless inputs share each digest and nothing in it says which one you started from. Sites that claim to decrypt or reverse SHA-256 keep lookup tables of digests they already computed for common strings and leaked passwords. They only find inputs that were guessable to begin with.
Which hash should I use?
SHA-256 for anything that matters: integrity checks, signatures, content addressing, cache keys an attacker could influence. SHA-512 is the same design with 64-bit words and a 128-character digest, often faster on 64-bit CPUs; SHA-384 is SHA-512 truncated. SHA-1 and MD5 are collision-broken (an attacker can craft two inputs with the same digest), so use them only to match checksums a legacy system already publishes.
What is HMAC?
HMAC (RFC 2104) is a hash keyed with a secret: HMAC-SHA-256 mixes the key into the message and hashes with SHA-256. Anyone holding the key can recompute it; nobody without the key can forge it. That is how webhook signatures, API request signing and HS256 JWTs authenticate a message. Enter the key and message in the HMAC section; the key is imported by Web Crypto in this tab and never leaves it.
Why doesn't my hash match the published one?
Count the characters first: 32 hex is MD5, 40 SHA-1, 64 SHA-256, 96 SHA-384, 128 SHA-512, and Verify tells you which algorithm it compared. If the algorithm is right, the bytes differ. Pasted text often carries a trailing newline, CRLF line endings or a UTF-8 BOM, any of which changes every character of the digest; for a file, hash the file itself in File mode instead of pasting its contents.
Are MD5 and SHA-1 safe?
Fine for checksums and cache keys, not for security. Both are broken for collision resistance, so an attacker can craft two inputs with the same digest. Use SHA-256 when integrity matters against an adversary.
Is this a password hasher?
No. Password storage needs a slow, salted KDF such as Argon2, scrypt or bcrypt, not a single SHA-256 of the password. A fast hash lets attackers test billions of guesses per second.
Related tools
Chosen for the same job, not just the same category.