Hash & Checksum Generator: MD5, SHA-1, SHA-256, SHA-512, CRC32

ℹ️ This content is educational and informational. It does not constitute professional advice. Consult a specialist before making decisions.

A hash is a fixed-length “digital fingerprint” that uniquely identifies content. Our hash & checksum generator computes cryptographic and integrity algorithms on text or files — 100 % in your browser, no uploads, works offline.

Supported algorithms

Cryptographic (security: signatures, certificates, blockchain, Git, TLS)

Algorithm	Length	Status	Main use
MD5	128 bit (32 hex)	💥 Broken (collisions 2004)	Legacy only / non-secure checksums
SHA-1	160 bit (40 hex)	💥 Broken (SHAttered 2017)	Legacy only / Git (migrating to SHA-256)
SHA-224	224 bit (56 hex)	✅ Secure	Certificates, compatibility
SHA-256	256 bit (64 hex)	✅ Current standard	TLS 1.2/1.3, Bitcoin, Git, signatures, Linux ISOs
SHA-384	384 bit (96 hex)	✅ Secure	TLS, high-security certificates
SHA-512	512 bit (128 hex)	✅ Secure	Password hashing (with salt/iterations), signatures
SHA3-256	256 bit	✅ Modern (Keccak)	Post-quantum, new designs
SHA3-512	512 bit	✅ Modern	Post-quantum
BLAKE2b	512 bit (configurable)	✅ Modern, faster than SHA-2	High-performance apps, Argon2
RIPEMD-160	160 bit	✅ Secure (niche)	Bitcoin (P2PKH addresses + SHA-256)

Checksums / Non-cryptographic (transmission/storage integrity)

Algorithm	Length	Use
CRC32 (ISO 3309)	32 bit (8 hex)	ZIP, PNG, gzip, Ethernet, SATA
CRC32C (Castagnoli)	32 bit	iSCSI, SCTP, Btrfs, ext4, Google Cloud Storage
Adler-32	32 bit	zlib, rsync (fast, less robust than CRC32)

CRC ≠ Cryptographic hash. CRC detects random errors (noise, bit rot). Does not resist intentional tampering.

HMAC (authentication + integrity with secret key)

Algorithm	Use
HMAC-SHA-256	JWT (HS256), webhooks (Stripe, GitHub, Slack), signed cookies, API keys
HMAC-SHA-512	High security, long keys

HMAC = H(key ⊕ opad, H(key ⊕ ipad, message)). Only key holder can generate/verify.

Architecture: 100 % Client-Side (Web Crypto API)

┌─────────────────────────────────────────────────────────────┐
│  BROWSER (your device)                                      │
│  ┌─────────────────┐    ┌───────────────────────────────┐  │
│  │ File API /      │───▶│ SubtleCrypto.digest()         │  │
│  │ Text Input      │    │ (SHA-256, SHA-384, SHA-512,   │  │
│  │                 │    │  SHA-1, MD5, SHA-3, BLAKE2*)  │  │
│  └─────────────────┘    └───────────────────────────────┘  │
│         │                        │                           │
│         │               ┌────────▼────────┐                 │
│         │               │ WASM (CRC32,    │                 │
│         │               │  CRC32C,        │                 │
│         └───────────────▶│  Adler-32,      │                 │
│                          │  RIPEMD-160)    │                 │
│                          └─────────────────┘                 │
│                                    │                         │
│                                    ▼                         │
│                          ┌─────────────────┐                │
│                          │ Hex / Base64    │                │
│                          │ Output + Copy   │                │
│                          └─────────────────┘                │
└─────────────────────────────────────────────────────────────┘
        ▲                         ▲
        │                         │
   ZERO NETWORK              ZERO SERVER

Web Crypto API (SubtleCrypto): native, CSPRNG, implemented in browser C++ (constant-time, side-channel resistant).
WASM for non-native algorithms (CRC32, CRC32C, Adler-32, RIPEMD-160, BLAKE2b) — compiled from Rust/Go, auditable.
Chunked streaming (2–8 MB): file.stream().pipeThrough(new TransformStream(...)) → crypto.subtle.digest() incremental. 10+ GB files without OOM.

Common use cases

Case	Algorithm	Flow
Verify Linux ISO / firmware	SHA-256	Download official `.sha256sum` → drag ISO → compare
Verify ZIP download / GitHub release	SHA-256 / SHA-512	Release assets → `sha256.txt` → compare
Backup / local file integrity	SHA-256 + CRC32	Crypto hash (security) + CRC (bit rot detection)
Sign API payload / webhook	HMAC-SHA-256	Shared secret → generate HMAC → `X-Signature` header
Verify Stripe / GitHub webhook	HMAC-SHA-256	Copy `Stripe-Signature` / `X-Hub-Signature-256` → paste key → verify
Bitcoin address (legacy)	SHA-256 + RIPEMD-160	`RIPEMD160(SHA256(pubkey))` → Base58Check
Git commit ID	SHA-1 (legacy) / SHA-256 (new)	`git hash-object` / `git log --format=%H`
File deduplication	SHA-256 / BLAKE2b	Hash each file → hash→paths map → detect duplicates

Built-in comparator (avoids visual errors)

Paste reference hash → comparator highlights:

Generated:  a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
Expected:  A591A6D40BF420404A011733CFB7B190D62C65BF0BCDA32B57B277D9AD9F146E
            ▲                                              ▲
         ✅ Match (case-insensitive hex)

Export for audit / CI

[
  {
    "file": "ubuntu-24.04-live-server-amd64.iso",
    "size": 1234567890,
    "algorithm": "SHA-256",
    "hash_hex": "a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e",
    "hash_b64": "pZGm1Av0IFAEgRczz7exkNYsbL8LzaM3V7J32a2fFG4=",
    "timestamp": "2026-09-13T10:15:30.123Z"
  }
]

Privacy and limits

Files never uploaded: File object → ReadableStream → SubtleCrypto.digest() — all in tab memory.
Offline: after first load (Service Worker / cache), works without internet.
Limits: browser RAM (Chrome/FF desktop ~ 4–8 GB heap; chunked streaming allows > 10 GB). Mobile: ~1–2 GB.
No logs, no analytics, no cookies on the tool.

Calculate hash / checksum now.

References

NIST FIPS 180-4 (SHA-1, SHA-2 family)
NIST FIPS 202 (SHA-3 / Keccak)
RFC 6234 (HMAC)
RFC 7693 (BLAKE2)
ISO 3309 / ISO 13239 (CRC32)
RFC 3720 (CRC32C / Castagnoli)
Bitcoin Protocol (RIPEMD-160 + SHA-256 → Base58Check)

Verify a download or sign a payload? → Open hash generator — drag your file, pick algorithm, compare instantly.