Hash Generator: SHA-256, SHA-3, BLAKE3, MD5

How to use the hash generator

Type or paste text, or switch to File and choose or drop files. Tick the algorithms you want; each result shows in hexadecimal and in Base64. Text is hashed as UTF-8, so it matches sha256sum run on a UTF-8 file with the same content. Set Input is to Hex bytes or Base64 to hash raw bytes instead. Files are read in 4 MB pieces in a background worker, so large files keep the page responsive; nothing is uploaded.

Several files give a table and a checksum list in the sha256sum format (hash name) to copy or download; sha256sum -c accepts it. Paste an existing SHA256SUMS or MD5SUMS list into the compare box to check every file at once.

To check a download, paste the published checksum into Compare with expected hash. The page names the algorithm that matches, and ticks it if it was hidden. Besides a bare value it reads sha256sum and b3sum lines (hash filename), the BSD format SHA256 (file) = hash, OpenSSL output, PowerShell’s Get-FileHash, certutil, 0x-prefixed Ethereum hashes and Subresource Integrity values such as sha384-oqVu….

The algorithms

Keccak-256 is not SHA3-256. Ethereum adopted Keccak before NIST changed its padding, so the two give different results: the empty string is c5d2460186f7… in Keccak-256 and a7ffc6f8bf1e… in SHA3-256. For SHAKE and BLAKE3 you can set the output length in bits; a shorter output is the start of a longer one.

SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser’s Web Crypto API. The others are implemented on this page and checked against the NIST, RFC 7693 and BLAKE3 test vectors and Python’s hashlib. CRCs are shown most significant byte first (cbf43926 for 123456789), the form crc32 tools print; the Base64 form matches Google Cloud Storage’s crc32c value.

HMAC and keyed hashes

Enter a key to turn the hashes into message authentication codes: HMAC (RFC 2104) for MD5, SHA-1, SHA-2, SHA-3 and RIPEMD-160, and the built-in keyed modes of BLAKE2 (key up to 64 or 32 bytes) and BLAKE3 (exactly 32 bytes). The key can be text, hex or Base64. HMAC-SHA-256 is what webhooks from services like GitHub and Stripe sign with, so you can recompute a signature by hand.

Which hash to use

Any of them spots a corrupted download; use the one the publisher lists. When someone might swap the file on purpose, use SHA-256, SHA-3 or BLAKE3: MD5 and SHA-1 collisions can be made deliberately, and a CRC is not cryptographic at all. None of these is fit for storing passwords, because they are designed to be fast; use Argon2id, scrypt or bcrypt.

Why a hash might not match

• Trailing newline. echo "abc" | sha256sum hashes abc plus a line feed. Use printf '%s' "abc" to get the value shown here.
• Line endings, encoding, invisible characters. A text box turns line breaks into LF, UTF-16 text is different bytes, and a copied string can carry a zero-width character. Hash the file itself instead.