Type text or choose a file and get its SHA hashes at once. Add a secret key for an HMAC signature, or paste an expected checksum to see whether it matches.
Runs entirely in your browser — nothing you enter here is sent to a server.
A cryptographic hash function turns any input — a word, a file, a whole disk image — into a short fixed-length string called a digest. The same input always gives the same digest. Change a single bit and the digest changes completely. And the function runs one way only: there is no method for getting from the digest back to the input other than guessing.
Those three properties make hashes the standard way to check that data is unchanged. A download page lists a SHA-256 checksum; you hash the file you received and compare. If the two strings are identical, the file is the one the publisher released, byte for byte.
The default choice. 256 bits, 64 hex characters. Used in TLS certificates, Git's newer object format, container image digests and most checksums.
Longer digests from the same family. SHA-512 is often faster than SHA-256 on 64-bit processors. SHA-384 is what Subresource Integrity usually uses.
160 bits, and broken: collisions have been produced in practice. Fine for identifying a Git commit, not for security decisions.
A hash mixed with a secret key. It proves the message came from someone who knows the key — the basis of webhook signatures and API request signing.
SHA-256 is built to be fast, which is exactly wrong for passwords: an attacker with a stolen database can try billions of guesses per second. Passwords need a deliberately slow, salted algorithm made for the job — Argon2, bcrypt or scrypt. Use the SHA family for integrity and signatures, never as a password hash on its own.
To verify a webhook, compute the HMAC of the raw request body with the shared secret and compare it to the signature header — the sender's documentation says which algorithm and encoding to use. Compare the raw bytes exactly as received; re-serialising the JSON first changes the hash.
Choose the file above, paste the published checksum into "Expected hash" and look for the match message. On the command line: sha256sum file on Linux, shasum -a 256 file on macOS, Get-FileHash file in PowerShell.
No. A hash is one-way; the original cannot be computed from the digest. Short or common inputs can still be found by guessing and comparing, which is why passwords need salted, slow algorithms.
Not for anything security-related. Practical collision attacks exist, so two different files can share a SHA-1 hash. Use SHA-256 or stronger. It remains acceptable as a plain non-security identifier.
MD5 is broken for security use and is not included in the browser's cryptography API. If you need it to match a legacy checksum, use md5sum on the command line.
Upzilla checks your sites, servers and APIs around the clock and alerts you the moment something breaks. 10 monitors free, no card required.