The Free Hash Generator Guide: MD5, SHA-256, CRC32 and HMAC, and How to Verify a File Checksum
You downloaded an installer or a disk image, and the page you got it from lists a long string of letters and numbers beside the link. Is your copy the same file they published? A hash generator answers that in seconds. The tool above works as an md5 hash generator, a sha256 hash generator and a checksum calculator at the same time: it shows MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 for any text or file together, and tells you which one matches the sha256 checksum (or any other checksum) you paste in. This guide covers the exact steps, what to do when a checksum does not match, HMAC signatures for developers, and the honest limits.
1. What a Hash Generator Does, and When You Need One
A hash is a fixed-length fingerprint of some data. Feed the same bytes in and you always get the same digest out; change a single byte and the digest changes completely. That makes a hash the quickest way to answer “are these two things identical?” without comparing them byte by byte.
People reach for an online hash generator free of sign-ups for a handful of everyday jobs:
- Checking a download. Operating system images, installers and firmware usually ship with a published checksum so you can verify the ISO checksum SHA256 value before flashing a USB stick or installing.
- Matching a legacy value. Older sites, cache keys and asset pipelines still list MD5 or SHA-1, which is when an md5 checksum tool or a sha1 hash generator earns its keep.
- Archives and ROMs. ZIP files and game ROM lists record CRC32 values, so a crc32 calculator tells you whether your copy is the listed one.
- Code and configuration. Developers paste a string to get its SHA-256 or use the sha512 hash generator row for a longer digest.
Switch the Source menu to Text and the digests update as you type; switch it to File and drop in any file type. The SHA family is defined in the NIST standard FIPS 180-4, which is why a correct SHA-256 is identical from every tool that implements it properly.
2. How to Verify a File Checksum in Three Steps
Here is how to verify a file checksum with the tool above. The same steps are how to check sha256 of a file, and equally how to get md5 hash of a file, because every algorithm is calculated at once.
- Choose File and add your download. Set Source to File, then drop the file on the panel or click to pick it. Its name and size appear so you know you chose the right one.
- Paste the published checksum. Copy only the hex string from the download page into Compare with. Upper or lower case does not matter.
- Look for the green row. If your file matches, the row for the right algorithm turns green and gets a tick after its name. No green row means no match, and section 4 explains what to do next.
That is the whole of the file hash checker online workflow, and it is also the easiest way to compare two hashes online: paste one, and the tool checks it against every digest it just produced. Each row has its own Copy button if you need to paste a value elsewhere.
It works the same way on any system, which covers two common searches. If you need a sha256 checksum on Windows without the command line, you do not have to learn certutil or PowerShell. And if you want to check a file hash on Mac online rather than typing shasum into Terminal, the steps above are all there is to it.
3. Which Hash Algorithm Is This? A Length Cheat Sheet
Download pages do not always say which algorithm they used. If you are asking which hash algorithm is this, the quick answer is that you do not need to know: the Compare box checks all six rows and lights up the one that fits. If you are curious anyway, the length of the hex string gives it away:
CRC32
8 hex characters
MD5
32 hex characters
SHA-1
40 hex characters
SHA-256
64 hex characters
SHA-384
96 hex characters
SHA-512
128 hex characters
Some places publish a digest in Base64 instead of hex, most often for web integrity attributes and API headers. Tick Show Base64 too and each digest also appears in Base64, which is the quick route from sha256 to base64. The Compare box matches hex values only, so compare a Base64 value by eye against the line under the hex.
SHA-3, SHA-224, BLAKE2, BLAKE3, RIPEMD-160, xxHash and CRC32C are not among the six. If a publisher uses one of those, this tool cannot check it, and the command-line tools in section 6 are the better route.
4. Checksum Does Not Match: Causes and Fixes
When the checksum does not match, the file is not byte-for-byte the one the publisher hashed. Before assuming the worst, run through the ordinary causes:
- Extra characters in the paste. Many checksum files put the file name after the hash. Paste only the hex string, with no name, label or line break.
- The wrong file or version. A different edition, architecture or release has a different checksum. Check the name beside the hash against the file you downloaded.
- An incomplete download. A dropped connection can leave a file that looks right but is short. Compare the size shown on the file chip with the size on the download page, and download again.
- Text that is not quite the same. In Text mode the tool hashes exactly what is in the box. A trailing space or new line, which some terminal commands add without asking, gives a different digest.
That is also how to tell if a download is corrupted: a mismatch after a fresh download from the official page means something is wrong with the copy, and you should not install it. A hash tells you that two files differ, not where. To see which lines changed between two texts, use the diff checker; for two versions of a document, the PDF compare tool shows the differences page by page.
5. HMAC SHA256 Generator for Webhooks and APIs
An HMAC is a hash mixed with a secret key, defined in RFC 2104. Payment platforms and code hosts use it to sign webhook payloads, and many APIs use it to sign requests. If your signature check keeps failing, an hmac sha256 generator lets you work out the expected value by hand.
Here is how to generate HMAC SHA256 with the tool: paste the exact message body into the text box and type the secret into HMAC key. Every row becomes its keyed version (HMAC-MD5, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 and HMAC-SHA-512), and the CRC32 row disappears because CRC has no keyed form. For an hmac sha256 webhook signature test, paste the signature from the request header into Compare with; if it is hex and your inputs are right, the HMAC-SHA-256 row turns green.
The key is read as plain text. If your secret is given in hex or Base64, the result will not match what your server computes from the decoded bytes. The same goes for the message: hex or Base64 input is hashed as the characters you see. The Base64 encoder and decoder can turn a Base64 value into readable text first when that is what it holds.
This row gives you a raw digest; it does not check a whole token. To read the header and claims of a JSON Web Token, use the JWT decoder.
6. The Command-Line Equivalents, and the Limits
If you prefer a terminal, every major system has a built-in command that produces the same values:
- Windows (Command Prompt):
certutil -hashfile yourfile.iso SHA256 - Windows (PowerShell):
Get-FileHash yourfile.iso -Algorithm SHA256 - macOS:
shasum -a 256 yourfile.iso - Linux:
sha256sum yourfile.iso
The terminal is also the right choice for the jobs this tool does not do. It hashes one file at a time, and the Compare box takes a single checksum, so it cannot check a whole SHA256SUMS or .md5 list line by line. It cannot hash a file from a web address. Very large files, such as multi-gigabyte ISO images, may be slow or fail to open, and there is no progress bar, so for those the commands above are more dependable. Password hashing schemes such as bcrypt, scrypt, Argon2 and PBKDF2 are not offered either.
It also helps to know what a hash is not. Hashing is not encoding: if you need text in Base64 or percent-encoded for a URL, use the Base64 tool or the URL encoder. And if you searched for a random hash for an ID or token, the UUID generator produces genuinely random identifiers, whereas a hash is always the same for the same input.
7. Why Use the Cortexis Hash Generator
Many hash pages cover a single algorithm, so if you are not sure which one a checksum uses you end up trying several sites. Here is what is different, stated so you can check every line yourself.
Six digests at once
MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 appear together for every text or file, each with its own Copy button.
Compare without guessing
Paste a published checksum and the matching row turns green with a tick, whichever algorithm the publisher chose.
HMAC on the same page
Add a key and every row becomes its HMAC version, so testing a webhook signature needs no second tool.
Your files stay private
Files and text are never stored on our servers and nothing you enter is retained after your session.
Nothing is used for training
What you hash is never used for training. A private document stays yours by policy.
Hex, uppercase or Base64
Switch to uppercase hex to match a listing exactly, or show each digest in Base64 for headers and integrity attributes.
It is one of a wider set of free developer and file tools built on the same terms, with no account and no sign-up.
8. Frequently Asked Questions (FAQ)
Can you decrypt an MD5 hash?
No. A hash is one-way: it is a fingerprint of the data, not an encrypted copy of it, so there is nothing to decrypt. Sites that claim to reverse MD5 are looking up hashes of common words they have already stored, which only works for short, guessable inputs. This tool does not attempt that.
Is MD5 secure?
For spotting accidental corruption in a download, MD5 still does the job. For anything where someone might deliberately forge a match, such as signatures or certificates, it is considered broken, and it should never be used to store passwords. Prefer SHA-256 when you have the choice, and use a dedicated password hashing scheme such as bcrypt or Argon2 for passwords.
How do I check the SHA-256 of an ISO file?
Set Source to File, drop the ISO on the panel and paste the SHA-256 value from the download page into Compare with. If the SHA-256 row turns green, your copy matches. For very large images that are slow to open here, the sha256sum, shasum or certutil command gives the same value.
What is a CRC32 checksum used for?
CRC32 is a short 8-character checksum used to catch accidental errors, and it is the value ZIP archives and many ROM and firmware lists record. Drop the file here to get the CRC32 checksum of a file online and compare it with the listing. It is not designed to resist deliberate tampering, so use SHA-256 for that.
Can I hash several files at once?
No, the tool takes one file at a time and the Compare box accepts a single checksum. To check a SHA256SUMS or .md5 list with many entries, the sha256sum or md5sum command with its check option is the faster route. For one or two files, drop each in turn.
Why does my HMAC not match what my server produces?
The most common reasons are a key given in hex or Base64, since the HMAC key box reads plain text only, and a message that differs slightly, such as reformatted JSON or a missing trailing newline. Paste the raw body exactly as it was received. Also check that you are comparing against the HMAC-SHA-256 row and that the header value is hex rather than Base64.
Is it safe to hash a private file here?
Your files and text are never stored on our servers, nothing is retained, and nothing is used for training. A digest cannot be turned back into the file, though a hash of a short, common word or password can be guessed by trying likely inputs, so treat hashes of secrets with the same care as the secrets themselves.
Does it support SHA-3 or bcrypt?
No. It calculates MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32, plus HMAC versions of the first five. SHA-3, SHA-224, BLAKE2, BLAKE3, RIPEMD-160 and password hashes such as bcrypt, scrypt, Argon2 and PBKDF2 are not available.
For the formal background on why MD5 is no longer trusted for security, see RFC 6151.
Checksum verified and ready for the next step? Open a downloaded archive with the archive extractor, tidy an API response with the JSON formatter, read a Unix time from a log with the timestamp converter, or test a pattern with the regex tester. And if you would rather understand how signatures and checksums fit into real applications, our free full-stack web development course covers the authentication and API groundwork behind tools like this one.