CODDY Tool

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files.

Produce every common hash at once from text or a file, verify a published checksum against your download, and sign messages with HMAC. Files are read in your browser, so nothing is uploaded no matter how large.

Everything you enter stays in this browser tab. Nothing is sent to our servers, logged or stored.

Loading tool…

What Hash Generator supports

Input

  • Hash text
  • Checksum a file
  • HMAC signature

Algorithms

  • MD5
  • SHA-1
  • SHA-256
  • SHA-384
  • SHA-512

About Hash Generator

A hash is a fixed-length fingerprint of some data. Change a single byte of the input and the output changes completely, which makes hashes the standard way to check that a file arrived exactly as it left — the reason projects publish a checksum alongside a download.

This produces every common algorithm at once, so you do not have to know in advance which one a publisher used. Paste a checksum into the verify box and it tells you which algorithm matched, or that none did.

Files are hashed in your browser. That matters more than it might sound: uploading a file somewhere to check its integrity defeats much of the point, and it means large files can be checked without waiting for an upload. SHA algorithms use the Web Crypto API, and MD5 is implemented here because Web Crypto deliberately omits it.

How to generate a hash

  1. Choose your input

    Hash text you type, checksum a file from your device, or sign a message with HMAC.

  2. Add the content

    Type the text or drop the file in. Text hashes update as you type.

  3. Read the results

    Every algorithm is shown at once, with the insecure ones clearly marked.

  4. Verify a checksum

    Paste a published checksum to confirm which algorithm matches, or that the file differs.

Which algorithm should I use?

  • SHA-256 — the sensible default for anything security-related.
  • SHA-512 — stronger, and faster than SHA-256 on 64-bit hardware.
  • SHA-384 — a truncated SHA-512, required by some standards.
  • SHA-1 — broken for security since 2017, but still used for Git object ids and older checksums.
  • MD5 — broken for security, still the most commonly published checksum for detecting a corrupted download.

What hashing is not

Hashing is not encryption. There is no key and no way to reverse it — which is the point, but it also means you cannot use it to hide something you need to read back later.

Hashing a password with a plain hash like SHA-256 is also not enough on its own. Password storage needs a deliberately slow algorithm such as bcrypt, scrypt or Argon2, because a fast hash is fast for an attacker too.

Frequently asked questions

Is my file uploaded to generate a checksum?

No. The file is read directly in your browser and hashed with the Web Crypto API, so nothing is transmitted. That is what makes it safe to checksum confidential files, and why the file size limit is about memory rather than bandwidth.

Which hash should I use for security?

SHA-256 unless something specifies otherwise. MD5 and SHA-1 can both be deliberately collided, so they must not be used for signatures or anything an attacker could target — the tool marks them clearly.

Why is MD5 still here if it is broken?

Because it is still the most commonly published checksum for verifying downloads, and detecting accidental corruption is a completely different problem from resisting a deliberate attack. For that job MD5 works fine.

Can I use this to hash passwords?

Not for storage. Password hashing needs a deliberately slow algorithm such as bcrypt, scrypt or Argon2, because a fast hash is just as fast for someone guessing billions of candidates. Use these for integrity checking, not password storage.

What is HMAC for?

HMAC combines a hash with a secret key to prove a message came from someone who holds that key and was not altered in transit. It is what webhook providers use to sign their requests so you can verify them.

How large a file can I checksum?

Up to about 500 MB. The whole file has to be held in browser memory because the Web Crypto API has no incremental digest, so very large files may fail on a device with limited memory.

Related tools

All Security Tools

Password Generator

Security Tools

Generate strong random passwords and memorable passphrases.

UUID Generator

Developer Tools

Generate UUIDs in bulk — random v4 or time-ordered v7 identifiers.

Base64 Encoder

Developer Tools

Encode text to Base64, with URL-safe and wrapping options.

Text Converter

Text Tools

Convert text to and from binary, hexadecimal, Morse code and Unicode escapes.

JSON Formatter

Developer Tools

Beautify minified JSON with proper indentation and a tree view.

Hash Generator is free to use with no account, no watermark and no usage limits. Last updated 14 August 2026.