Hash Generator Pro
Checksums for verifying a download arrived intact, comparing two files without opening them, or signing a payload with an HMAC. Everything runs on your own machine. Free preview · Pro required to export. Hash up to 3,000 characters or a 5 MB file free. HMAC signing and larger inputs need Pro.
Free preview · Pro required to export. Hash up to 3,000 characters or a 5 MB file free. HMAC signing and larger inputs need Pro.
Why use this tool?
- A download page publishes a checksum so you can prove the file you received is the file they sent. Checking it should not mean uploading the file somewhere.
- Comparing 64 hex characters by eye is exactly the task eyes are worst at — so paste the published checksum and let it be compared.
- Webhook signatures are HMACs, and reproducing one by hand is the fastest way to debug a signature that will not verify.
How to use Hash Generator
- Choose text or a file.
- Every digest is computed at once — read the one you need.
- For a signature, tick HMAC and enter the secret.
- Paste a published checksum to have it compared for you.
Features
- MD5, SHA-1, SHA-256, SHA-384 and SHA-512, all at once
- Files of any size, read locally and never uploaded
- HMAC with any SHA variant, for webhook signatures
- Hex or Base64 output, upper or lower case
- Checksum comparison that ignores case and spacing
Tips
- A matching MD5 proves a file is undamaged, never that it is untampered with — both MD5 and SHA-1 have practical collision attacks. Use SHA-256 when the question is trust.
- If an HMAC will not match, the cause is almost always encoding: check whether the payload is being signed as raw bytes or after being re-serialised.
Frequently asked questions
Can I use SHA-256 to store passwords?
No. It is fast by design, which is exactly what makes it wrong for passwords — a GPU will try billions of candidates a second against it. Passwords want bcrypt, scrypt or Argon2, which are deliberately slow.
Why is MD5 here if it is broken?
Because real files are still distributed with MD5 checksums and nothing else. It remains perfectly good at catching a corrupted download, which is what a checksum on a mirror is for.
Are my files uploaded?
No. Hashing uses the Web Crypto API in your browser and the file never leaves your device.
Can I try this Pro tool without an account?
Yes. Hash up to 3,000 characters or a 5 MB file free. HMAC signing and larger inputs need Pro. Your own input is processed locally in your browser.
Will upgrading keep my work?
Checkout and login open in a separate tab. Keep the workspace open to retain inputs, settings and previews. Files stay in that tab only; keep the originals in case you close or reload it. Export access is checked with the server after payment.
Your files are processed directly in your browser and are not uploaded to HubToolify's servers.