Hash generator and verifier
Compute MD5, SHA-1, SHA-2, SHA-3, BLAKE2 and BLAKE3 checksums or HMACs of text or a file and compare them with a published value. Create bcrypt, Argon2id, scrypt and PBKDF2 password hashes with recommended settings, or check a password against an existing hash from PHP, Django, Flask, passlib or Node. Passwords and files never leave your browser.
What you can do
- Checksums of text or files: MD5, SHA-1, SHA-224/256/384/512, SHA-512/256, SHA3, BLAKE2b, BLAKE2s, BLAKE3, RIPEMD-160
- HMAC with any of those algorithms
- Match a file against a published checksum, including sha256sum and BSD formats
- Generate bcrypt, Argon2id/i/d, scrypt and PBKDF2 hashes with OWASP-recommended defaults
- Verify passwords against bcrypt ($2a$, $2b$, $2y$), Argon2 PHC, scrypt and PBKDF2 hashes from passlib, Django and Werkzeug
- Warnings for weak cost settings and broken algorithms
Frequently asked questions
Is my password sent anywhere?
No. Hashing and verification run in JavaScript in this tab. Nothing you type or drop is uploaded or logged.
Which password hash should I use?
Argon2id with at least 19 MiB of memory and 2 iterations, as recommended by OWASP. Use bcrypt with cost 10 or more where Argon2 isn't available, and PBKDF2 with 600,000 SHA-256 iterations when you need FIPS-approved algorithms.
Why does the same password give a different hash each time?
Each hash gets a new random salt, which is stored inside the hash string. Verification reads the salt back out, so any of those hashes will check correctly.
Related tools
- JWT decoder — Decode and verify JWTs with a key, JWKS or x5c chain
- Viewer — Inspect and debug certificates, PFX files, keys, CSRs and CRLs
- SSH key viewer — Read SSH keys and certificates with fingerprints