Question 1

Which hash algorithm should I use?

Accepted Answer

SHA-256 is the most common general-purpose choice today — used for checksums, Git commit hashes, and most security-relevant integrity checks. SHA-512 offers a larger digest for extra collision resistance. MD5 and SHA-1 are both cryptographically broken and should not be used for security purposes, but they're still common for verifying file integrity against a known checksum (e.g. software download pages).

Question 2

Is MD5 safe to use?

Accepted Answer

No — MD5 is cryptographically broken; it's practical to construct two different inputs that produce the same hash. It's still fine for non-adversarial checksums (e.g. confirming a file wasn't corrupted in transit), but never use it for passwords, signatures, or anything security-sensitive.

Question 3

Can I hash a password with this tool?

Accepted Answer

You can, but none of these algorithms (MD5, SHA-1, SHA-256, SHA-512) are designed for password storage — they're fast general-purpose hashes, which makes them easy to brute-force. Passwords should be hashed with a slow, salted algorithm like bcrypt, scrypt, or Argon2 instead.

Question 4

Is my text sent anywhere?

Accepted Answer

No. All four hashes are computed locally in your browser; nothing is transmitted to a server.

Question 5

Why do the hashes change when I toggle Uppercase?

Accepted Answer

Hex digests are conventionally written in lowercase, but some tools and file formats expect uppercase hex. The toggle only changes the text casing shown here — it doesn't change the underlying hash value.

Question 6

What is HMAC, and when should I use it?

Accepted Answer

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key, so the resulting value proves both that the message wasn't altered and that whoever produced it knew the key — a plain hash only proves the former. Use it to verify messages between parties who share a secret (e.g. webhook payload signatures); use a plain digest when you just need a checksum with no shared secret involved.

Question 7

How do I verify a file's checksum against a published value?

Accepted Answer

Hash the file on the File tab, then paste the published checksum into the Expected hash field that appears below the results. You don't need to extract just the hex value first — pasting a whole checksum-file line, like the output of sha256sum ( ) or a BSD/OpenSSL-style line (e.g. SHA256 () = ), works too, since the tool pulls the hash out of it automatically. The tool detects which algorithm the value belongs to by its length and shows a Match or No match badge directly on that row — no need to manually compare long hex strings by eye.

Hash Generator

How to use the Hash Generator

How This Tool Works

Frequently Asked Questions

Related tools