Start a project

Tool 44 of 57 · Security

Hash & SRI Generator

Hash text or a file with SHA-256 and friends, check a download against its published checksum, and make the integrity attribute for CDN scripts.

Use the tool All developer tools Live · free
Hash & SRI Generator at a glanceIllustration: 1, Text or a file; 2, processed in your browser; 3, Hashes + SRI.Hash & SRI Generator1Text or a file#3Hashes + SRI2In yourbrowser
1 Text or a file 2 processed on your device 3 Hashes + SRI

Hash & SRI Generator

Input

Leave empty for a plain hash. With a secret you get an HMAC, used to sign webhooks.
Paste a published checksum to check a download

Hashes

AlgorithmHex

Subresource Integrity

For a script or stylesheet you load from a CDN: the browser refuses the file if it ever changes.

integrity attribute
All hashes

01

What it does

Makes SHA hashes and HMACs of text or files, compares checksums and writes Subresource Integrity attributes.

  • SHA-1, SHA-256, SHA-384 and SHA-512
  • Text or any file, using WebCrypto
  • HMAC with a secret key
  • Compare against a published checksum

02

Private by design

Everything happens in your browser. Nothing you type, paste or upload is sent anywhere, and it keeps working offline once the page has loaded.

03

What you get

Hex hashes and an SRI attribute, with a Copy and a Download button on every result.

  • SHA-256
  • SRI
  • HMAC

Why it matters

A hash is a fingerprint: change one byte and it changes completely. That makes hashes the way to check a download hasn't been tampered with, and the basis of Subresource Integrity, which stops a hacked CDN from serving you a changed script.

HMACs, hashes with a secret, are how Stripe, GitHub and most services sign their webhooks. This tool makes all of them with your browser's built-in WebCrypto, so files and secrets stay on your device.

How it works

  1. InputText or any file
  2. In your browserHashed with WebCrypto (plus MD5 for old checksums)
  3. OutputMD5, SHA-1, SHA-256/384/512, HMAC and an integrity attribute

Where it fits in a designer's workflow

  1. Plan
  2. Design
  3. Build
  4. Test
  5. Launch
Checking downloads and adding SRI to CDN scripts.

By the numbers

Digest size of each algorithmMD5: Broken: don't use for security: 128 bits; SHA-1: Broken: collisions found in 2017: 160 bits; SHA-256: Secure: 256 bits; SHA-384: Secure (used for SRI): 384 bits; SHA-512: Secure: 512 bitsMD5: Broken: don't use for security128 bitsSHA-1: Broken: collisions found in 2017160 bitsSHA-256: Secure256 bitsSHA-384: Secure (used for SRI)384 bitsSHA-512: Secure512 bits
Sizes measured with Python's hashlib on 'hello world'. MD5 and SHA-1 are still fine for spotting accidental file damage, but not for passwords or signatures. Passwords need a slow hash like bcrypt or Argon2, not any of these. Source: NIST: hash functions; SHAttered (2017).
Show the numbers as a table
AlgorithmBitsHash of 'hello world'
MD51285eb63bbbe01eeed093cb22bb8f5acdc3
SHA-11602aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256256b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-384384fdbd8e75a67f29f701a4e040385e2e23986303ea10239211af907fcbb83578b3e417cb71ce646efd0819dd8c088de1bd
SHA-512512309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f

How to use it

  1. Type text or choose a file.
  2. Add a secret for an HMAC, or a published hash to compare.
  3. Read the hashes in the table.
  4. Copy the integrity attribute or download all the hashes.

FAQ

Which algorithm should I use?

SHA-256 for checksums and HMACs, SHA-384 for Subresource Integrity. SHA-1 is broken for security and is here only for old checksums.

Why no MD5?

Browsers' WebCrypto doesn't offer MD5 because it's broken. Use SHA-256 instead.

Can I hash passwords with this?

Don't store passwords as plain SHA hashes. Use a slow password hash such as Argon2 or bcrypt on your server.

Is my file uploaded?

No. It's hashed in your browser.

Work with me

Want a site that gets these right?

I build fast, accessible websites and web apps that pass these checks from day one. Tell me about your project and I'll reply personally with honest next steps.

Start a project What I do

All developer tools · Back to leej.uk