Calculate hashes
Free online hash calculator that runs entirely in your browser. Paste text or drop a file of any size, pick one or several algorithms (MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32), pick hex or base64 output, optionally set a key to compute HMAC variants instead of plain digests. The file is read as a stream and every selected algorithm is fed from the same chunk, so nothing is ever held in memory. A comparison block at the bottom takes two hash strings and tells you whether they match — useful for verifying file integrity against a published checksum.
How to use
Text tab for typing, File tab for drag-and-drop.
Tick the boxes you want — they all compute in parallel.
Hex for traditional display, base64 for JWT-style.
Click a result to copy it; use Compare to verify against a known hash.
Hash text or files in the browser — MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, with HMAC
Compare two hashes
What you can do
Typical uses
- Verify a downloaded ISO against its published SHA-256 checksum.
- Compute a content hash for cache-busting or ETag generation.
- Calculate a JWT-style HMAC-SHA256 for API request signing.
- Quickly produce an MD5 for a legacy system that still asks for it.
- Spot-check whether two large files are identical without diffing them.
Why this one
Many online hash tools fail on large files because they load the whole thing into memory at once — and so did this one, because crypto.subtle.digest() takes the entire input in a single buffer and has no MD5 at all. It now streams the file and feeds every selected algorithm from the same chunk, so there is no size cap: only time. Measured in Chromium: MD5 126, SHA-1 89, SHA-256 66, SHA-384/512 16, CRC-32 287 MB/s. HMAC and CRC32 are first-class — most online tools skip them. Output matches `sha256sum`, `md5sum`, OpenSSL and every other standard implementation.
Common questions
Is MD5 still safe to use?
Not for security purposes — MD5 has been broken since 2004. It is still fine as a fast content-checksum (cache keys, dedup) where you do not care about adversarial collisions. For signatures, password storage or anything security-sensitive, use SHA-256 or better.
When do I need HMAC instead of a plain hash?
Whenever the point is that only you could have produced the value. A plain SHA-256 of a message can be recomputed by anyone who has the message, so it proves the content is unchanged but says nothing about who computed it — an attacker who rewrites the message simply rewrites the hash beside it. HMAC folds a secret key into the computation, so the result can only be reproduced by someone holding that key. That is why webhooks are signed with it: the receiver recomputes the HMAC with the shared secret and knows the payload really came from the sender. If nobody is trying to forge anything, a plain hash is the right and simpler tool.
Why is hashing a big file slower on my phone?
Because hashing is pure computation and a phone has less of it to spend. The file itself is never a problem: it is read in chunks and streamed through the browser's native crypto implementation, so nothing is held in memory and the size of the file does not matter to the memory at all. What matters is throughput, and a desktop processor with hardware acceleration for SHA can be several times faster than a phone at exactly the same task. A large archive that takes a minute on a laptop can take several on a phone, with the screen needing to stay awake for the whole of it — which is the practical reason to do a multi-gigabyte verification on a computer.
How are large files handled?
The file is read in 4 MB chunks and hashed in your browser through the native Web Crypto API, so even a 4 GB ISO can be checksummed without loading it all into memory at once. The result matches `sha256sum` on Linux / `shasum -a 256` on macOS / `certutil -hashfile` on Windows.
Hex or base64 — which should I use?
Hex is the traditional representation (the kind you see on download pages). Base64 is shorter and is what JWT and many web APIs use for HMAC signatures. Pick whichever the system you are talking to expects.
We can! Just send us a quick message with your idea. If you'd like to discuss it in detail, leave your email and we'll get back to you. You can stay anonymous.
