DE EN IT

~/tools / hash-generator

Hash generator

Enter text or pick a file and read off SHA-256, SHA-512, SHA-1 and MD5, optionally as HMAC, with a compare field for the expected value. The file is not uploaded.

Output
daniele@mikweb: ~/tools — less hash-generator.md

What hashes are for

A hash function turns data of any length into a value of fixed length, a fingerprint. The same data always gives the same hash; a single changed bit gives a completely different one. You cannot compute the content back from the hash. That makes a hash not encryption: there is nothing to decrypt, but short or guessable inputs (simple passwords, say) can be found by trying candidates and lookup tables.

Typical uses: checking downloads and backups for integrity, comparing files or finding duplicates, building cache keys and content addresses (Git, Docker digests), integrity attributes for scripts (sha384-… in Subresource Integrity) and digital signatures, which sign the hash of the document.

HMAC adds a secret key: only someone who knows it can compute the matching value. Webhooks use it to protect their messages (for example X-Hub-Signature-256 at GitHub). Here you can recompute HMAC-SHA-256 and HMAC-SHA-512 when a signature does not match.

Which algorithm? MD5 and SHA-1 are broken

  • SHA-256 is the default choice: available everywhere, fast, secure. When in doubt, use it.
  • SHA-384 and SHA-512 belong to the same SHA-2 family. They give longer values and are often faster on 64-bit systems. SHA-384 is a truncated variant of SHA-512 and is used, for example, in Subresource Integrity.
  • SHA-1 is considered broken: real collisions have been known since 2017, followed by chosen-prefix attacks in 2019/2020. It is no longer acceptable for signatures and certificates.
  • MD5 has been broken for even longer; collisions can be generated in seconds. Never use MD5 where an attacker may be involved. It is still common for plain checksums against transfer errors or for matching legacy systems, which is why it is explicitly marked “not secure” here.
  • Passwords do not belong in a plain SHA-256. Use deliberately slow schemes such as Argon2id, scrypt, bcrypt or PBKDF2.

Verifying downloads: sha256sum, shasum, Get-FileHash

Compare the hash of the downloaded file with the one the vendor publishes. Here you simply pick the file in the file field; it is not uploaded but read locally. On the command line:

  • Linux: sha256sum file.iso; with a vendor list: sha256sum -c SHA256SUMS --ignore-missing
  • macOS: shasum -a 256 file.iso
  • Windows PowerShell: Get-FileHash file.iso -Algorithm SHA256; in the command prompt certutil -hashfile file.iso SHA256
  • Anywhere with OpenSSL: openssl dgst -sha256 file.iso

Paste the expected value into the compare field: case and whitespace do not matter, and a whole line from SHA256SUMS is recognised too. Note that if the hash sits on the same page as the download, it only protects against transfer errors, not against a tampered page. Also check the signature (GPG) when the vendor provides one.

Frequently asked questions

  • Why does my text hash differ from sha256sum? Usually because of the trailing newline: echo abc | sha256sum hashes “abc” plus a newline. Use printf %s abc | sha256sum or echo -n abc. Line endings (LF or CRLF) and the character encoding change the hash too; this tool encodes text as UTF-8.
  • Is my file uploaded? No. It is read in the browser as an ArrayBuffer and computed locally. Because of memory, 512 MB is the limit.
  • Hex or Base64? Hex is usual with sha256sum and Docker digests; Base64 with Subresource Integrity and many APIs. It is the same value written differently, and the compare field understands both.
  • Why no HMAC with MD5 or SHA-1? Only HMAC-SHA-256 and HMAC-SHA-512 are offered on purpose, as the others are no longer recommended for new designs.
  • The key is empty? HMAC needs a non-empty key, otherwise the tool shows an error.

Privacy

Runs entirely in your browser; nothing is sent or stored.

daniele@mikweb: ~/tools — ls

Tools

SPF checkerCounts the DNS lookups of your SPF record (limit: 10).DNS TTL plannerPlans the TTL reduction and the move time.Cron explainerExplains cron expressions and shows the next runs.DMARC generatorBuilds a valid DMARC record to copy.Mail DNS checkChecks MX, reverse DNS, SPF, DMARC and MTA-STS of a domain.Certificate checkExpiry, chain and names of a TLS certificate.Security headersGrades HSTS, CSP and other security headers.JWT decoderShows header, claims and expiry of a JWT — in your browser only.SAML decoderDecodes SAML responses and spots typical errors.nginx for NextcloudGenerates an nginx config for Nextcloud with PHP-FPM.Explain an errorPaste an error — meaning, causes and checks (AI).Base64 encode/decodeEncode and decode Base64, files and Basic-auth headers included — in your browser only.chmod calculatorFile permissions octal ↔ symbolic, ready chmod commands and umask — in your browser only.Subnet calculatorWorks out CIDR, netmask, wildcard and hosts for IPv4 and IPv6 and splits networks into subnets.Epoch converterConvert Unix timestamps to dates and back, with time zones and a year-2038 check — in your browser only.JSON formatterFormat, minify, sort and validate JSON, with errors shown by line and column — in your browser only.Password generatorRandom passwords and passphrases with an entropy readout — generated in your browser only.Redirect generatorGenerates redirects for nginx and Apache (.htaccess) with a curl test.

← Tools