Hash Generator: MD5, SHA-1, SHA-256, SHA-512 & HMAC
Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes or HMACs of text or files in your browser and compare them with an expected checksum.
The text is hashed exactly as entered, including spaces and line breaks. Line breaks in this box are hashed as LF.
Drop a file here or choose one
No file selected.
This file is larger than 500 MB. The whole file is loaded into memory, so the browser may run out of memory or become slow.
Results
Enter text or choose a file to see its hashes.
Hex values are compared without regard to upper or lower case; Base64 values must match exactly.
Notes
- MD5 and SHA-1 have known collision attacks and should not be used for security purposes. Use them only for non-security checks, such as comparing a download with a published checksum.
- A hash is not encryption. This tool cannot turn a hash back into the original text or file.
- Do not use plain hashes to store passwords. Use a dedicated password hashing scheme such as Argon2, scrypt or bcrypt.
- Hashes are calculated from bytes, so the same text with different line endings (CRLF or LF), a different character encoding or extra spaces gives a different hash.
- HMAC combines a hash with a secret key. HMAC-MD5 is not offered here.
- Text and files are processed in your browser and are not sent to LeedyBox. Very large files can be slow, because the whole file is read into memory.
How to use
- Under "Input", choose "Text" to hash text you type or paste, or "File" to hash a file from your device.
- For a file, choose it or drop it on the box, then press "Calculate hashes". If you change "HMAC mode" or the key afterwards, press the button again.
- Choose an "Output format": lowercase hex, uppercase hex or Base64. Changing the format only changes how the same results are written, so nothing is calculated again.
- To calculate HMACs instead of plain hashes, tick "HMAC mode" and enter the secret key in the field that appears. HMAC-MD5 is not offered, so the MD5 row shows "Not available for HMAC".
- To verify a download, paste the published value into "Expected checksum (optional)". It is compared with every calculated result, and the matching row is marked "Match".
Frequently asked questions
Why is my hash different from the one sha256sum or another tool gives?
The text box hashes exactly the characters you enter, so small differences change the result. A common cause is a trailing line break: echo hello | sha256sum hashes "hello" plus a newline, which gives a different SHA-256 than "hello" alone, while printf hello | sha256sum does not add one. Characters that look the same can also be stored differently, for example é as one code point or as e followed by a combining accent. To hash the exact bytes of a file, use "File" instead of pasting its content, because the text box encodes the text as UTF-8 and hashes line breaks as LF.
The published checksum is correct, so why is there no match?
Paste only the hash value. Spaces, tabs and line breaks are removed before the comparison, so if you paste a whole line from a checksum file, the file name becomes part of the value, and a prefix such as sha256: also prevents a match. Every calculated algorithm is checked, so you do not need to pick one. If only the value is pasted and it still does not match, check that "HMAC mode" is off and that the checksum uses MD5, SHA-1, SHA-256, SHA-384 or SHA-512; other algorithms, such as SHA-3 or BLAKE2, are not calculated here. Otherwise, the file most likely differs from the one the checksum was made for, for example a different version or an incomplete download.
What does it mean when the result starts with e3b0c442 or d41d8cd9?
These are the hashes of empty input (0 bytes) written in hex: the SHA-256 value starts with e3b0c442 and ends with b855, and the MD5 value is d41d8cd98f00b204e9800998ecf8427e. With "HMAC mode" off, you see them after clearing the text box or for a file that is 0 bytes long. If a program of yours produces one of these values for data that should not be empty, it most likely hashed an empty string or an empty file.
Can I check a webhook or API signature with HMAC mode?
Often, yes, if the signature is an HMAC with SHA-1, SHA-256, SHA-384 or SHA-512; HMAC-MD5 is not offered. Tick "HMAC mode", enter the signing secret, use the request body as the input and paste the signature into "Expected checksum (optional)" without a prefix such as sha256=; hex and Base64 signatures are both recognized. The input must have the same bytes that were signed, so a reformatted JSON body will not match, and a body with CRLF line breaks needs to be saved as a file and hashed with "File". Many services sign more than the body, such as a timestamp and a separator placed in front of it, so check the service's documentation for exactly what is signed.
My secret key is given in hex or Base64. Can I use it?
Only if the service uses the key text as it is. The "Secret key (UTF-8)" field uses the UTF-8 bytes of the characters you enter and does not decode hex or Base64, so if the service decodes its key before signing, the HMAC calculated here will not match. Spaces at the start or end of the field are part of the key as well.
How do I create a Subresource Integrity (SRI) hash?
Choose "File", select the script or stylesheet, make sure "HMAC mode" is off, press "Calculate hashes" and set "Output format" to "Base64". Put sha384- in front of the SHA-384 value to get the value for the integrity attribute; sha256- and sha512- work the same way. The file must have the same bytes as the one the browser downloads, otherwise the browser refuses to use it. A file loaded from another origin also needs the crossorigin attribute, and its server must allow CORS.
What is the difference between hex and Base64 output?
Both encode the same digest. Hex uses two characters per byte, 64 characters for SHA-256, and is what tools such as sha256sum print; Base64 is shorter, 44 characters for SHA-256. The Base64 output uses the standard alphabet with + and / and = padding, not the URL-safe variant with - and _, so a value in the URL-safe variant, or one with the = padding removed, may not match in the comparison.