Skip to content
MtrXTools

Hash generator

Hash text or a file with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, compare against a checksum you were given, and compute an HMAC with a secret key to check webhook signatures. Runs in your browser; files are not uploaded.

What it does

  • Hashes text (as UTF-8) or a file of up to 200 MB with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at the same time, in hex (lower or upper case) or base64.
  • Compares against a checksum you were given: paste a bare hash in hex or base64, a line from sha256sum or a SHA256SUMS file, or BSD-style SHA256 (file) = ..., and it shows which algorithm matches.
  • Computes an HMAC with a text, hex or base64 key using MD5, SHA-1, SHA-256, SHA-384 or SHA-512, shown in hex and base64.
  • Verifies a webhook signature such as GitHub's X-Hub-Signature-256: sha256=... or Stripe's v1=...; the name= prefix is stripped automatically.
  • Files are read and hashed in your browser with Web Crypto and are never uploaded.

Checksums, hashes and HMACs

A hash turns any input into a short fixed-length value; changing one bit of the input changes the hash completely. Download pages publish a SHA-256 checksum so you can confirm the file arrived intact. MD5 and SHA-1 still catch accidental corruption, but collisions can be made on purpose, so use SHA-256 or stronger when the point is to prove a file is genuine.

An HMAC mixes a secret key into the hash. Only someone with the key can produce the right value, which is why webhook providers sign each request body with an HMAC: the receiver recomputes it with the shared secret and rejects the request if it differs.

Questions

Why does my hash differ from the one in the terminal?
Usually a trailing newline: echo "text" | sha256sum hashes the text plus a newline, while this tool hashes exactly what you typed. Use printf '%s' "text" | sha256sum or echo -n. Different line endings (CRLF vs LF) or text encodings also change the result.
Is MD5 still safe to use?
Not for security. Researchers can create two different files with the same MD5 (and SHA-1) hash, so they can't prove a file is genuine or protect passwords. They are still fine as a quick check for accidental corruption, which is what many old checksums are for.
Why doesn't my webhook signature match?
The HMAC must be computed over the raw body exactly as sent, before any JSON parsing or re-formatting. Check the key format (some providers give a base64 or hex secret, and Stripe uses the whole whsec_... string as text) and whether the provider signs extra data, such as Stripe's timestamp.body.
Should I hash passwords with SHA-256?
No. Fast hashes let attackers try billions of guesses per second. Store passwords with a slow, salted password hash such as Argon2id, scrypt or bcrypt.

Related tools