Hashing Tools
Check downloads, generate SHA, MD5 and HMAC hashes, create Argon2 and bcrypt password hashes, and validate check digits, all privately in your browser. Learn more
Adler-32 Checksum
Fast checksum used in zlib/PNG.
Argon2 Hash Generator
Generate or verify an Argon2id password hash with adjustable cost parameters
Batch Checksum Generator
Hash several labelled blocks at once.
bcrypt Hash Generator/Verifier
Generate or check, via the bcryptjs library.
BLAKE2 Hash Generator
BLAKE2b/2s, verified vs. RFC test vectors.
Brute-Force Time Estimator
Real GPU cracking speeds, from MD5 to bcrypt.
CRC32 Checksum Generator
For catching accidental data corruption.
File Hash Checker
MD5, SHA-1, SHA-256 and SHA-512 at once, without uploading.
FNV Hash Generator
Compute FNV-1 and FNV-1a non-cryptographic hashes in 32-bit and 64-bit
Hash Comparison Tool
Check whether two hashes match.
Hash Identifier
Recognise bcrypt, Argon2, SHA and 20+ other formats.
HMAC Generator
Keyed hash for message authentication.
ISBN/EAN/UPC Checksum Validator
Validate or generate the check digit for ISBN, EAN-13, EAN-8 or UPC-A codes
Luhn Checksum Validator
Validate or generate the Luhn mod-10 check digit used by card-style numbers and IMEIs
MD5 Hash Generator
Fast checksums — not for security-sensitive use.
NTLM Hash Generator
Generate the legacy Windows NTLM password hash (MD4 of UTF-16LE)
Password Hashing Algorithm Guide
bcrypt vs. Argon2 vs. scrypt vs. PBKDF2.
PBKDF2 Key Derivation Calculator
Native Web Crypto, verified vs. Node.
scrypt Calculator
Derive an scrypt key with adjustable N/r/p memory-hard cost parameters
SHA-3 (Keccak) Hash Generator
SHA3-224 to 512, plus Ethereum's Keccak-256.
SHA Hash Generator
SHA-1, SHA-256, SHA-384 or SHA-512.
Hash, checksum and password-hashing tools for developers and everyday checks
A hash is a short fingerprint of some data: change one character and the fingerprint changes completely. The most common everyday use is checking a download. Drop the file into the File Hash Checker, paste the hash from the website, and you'll know at once whether you've got the genuine, undamaged file. The Hash Comparison tool checks two hashes side by side, and the Hash Identifier tells you what kind of hash you're looking at.
Developers will find every common algorithm here, all running in the browser. Generate hashes with the SHA-256 and SHA-512 Generator, SHA-3 (and Ethereum's Keccak-256), BLAKE2 and the MD5 Generator. Sign and check webhooks and API requests with the HMAC Generator. For quick checksums there's CRC32, Adler-32 and FNV, plus the Batch Checksum Generator for many items at once. The Luhn and ISBN/EAN/UPC validators check the digit that catches typos in card numbers and barcodes.
Storing passwords properly takes a different kind of hash, one that's deliberately slow. Generate and verify real password hashes with the Argon2, bcrypt, scrypt and PBKDF2 tools, and see why the choice matters with the Brute-Force Time Estimator. The Password Hashing Guide compares them, with the settings OWASP currently recommends.
Questions and answers
- Should I check a download with MD5, SHA-1 or SHA-256?
- Use whichever one the download page publishes. The File Hash Checker works out all of them at once, so just paste the published hash in and it finds the match. If you have a choice, SHA-256 is best. MD5 and SHA-1 still reliably catch a file that was damaged in transit, but deliberate forgeries are possible with them, so they're not proof against tampering.
- What's the difference between a plain SHA-256 hash and an HMAC?
- Anyone can work out the SHA-256 of a message, so a hash alone only shows that the data hasn't been changed by accident. An HMAC mixes in a secret key, so only someone who knows the key can produce the right value. That proves the message came from them and wasn't altered. This is how services like Stripe and GitHub sign webhooks. Use the SHA Generator for checksums and the HMAC Generator for checking signatures.
- Argon2, bcrypt, scrypt or PBKDF2: which should I use to store passwords?
- Argon2id is the first choice for new systems: it's slow and uses lots of memory, which makes graphics-card cracking expensive. bcrypt is a well-tested second choice, but it ignores anything past 72 bytes of a password. scrypt is also memory-hard and solid. PBKDF2 is the weakest of the four, but it's the one to use if you need FIPS compliance, with at least 600,000 iterations. Never store passwords with MD5, SHA-1, SHA-256 or NTLM, however much salt you add. The Password Hashing Guide has OWASP's recommended settings for each.
- Why do the Hash Identifier's suggestions sometimes list several algorithms?
- A bare hash is just a string of characters, and different algorithms can produce the same length: MD5 and NTLM are both 32 hex characters, and SHA-256 and SHA3-256 are both 64. Password hashes like bcrypt (
$2b$…), Argon2 ($argon2id$…) and Linux$6$hashes describe themselves, so those are identified for certain. For a bare hash, hash some known text with each candidate and see which tool's output matches. - Is a Luhn or ISBN check digit a kind of hash?
- It's a close relative: a tiny checksum built into the number itself. The Luhn check on card numbers and the check digit on ISBN, EAN and UPC barcodes catch most single-digit typos and swapped neighbouring digits, so a shop till or website can reject a mistyped number straight away. They offer no security, though: a number that passes is simply well-formed, not genuine. The validators also work out the correct check digit, and convert ISBN-10 to ISBN-13.