# Hash generator: run it free, or from your agent

MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, as hex or Base64, with HMAC and a checksum compare.

## Prompt

Use looot to find which saved results changed between two runs. 1. Set up https://looot.ai/skill.md. 2. Search the catalog for [the endpoint I ran] and check its price before you call. 3. Run it again with the same input. 4. Take the SHA-256 of the new response body and compare it with this hash from last time: [hash]. 5. If they differ, list the fields that changed.

## What it needs

Text or a file, and an optional HMAC key

## What comes back

- MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests
- hex or Base64 output
- HMAC digests
- which hash a pasted checksum matches

## Endpoints and providers

None. The tool on the web page runs in the browser and calls no endpoint.

## What it costs

Nothing. The tool on the web page runs in the visitor's browser: no account, no API call and no limit per hour. The prompt above runs the same job from your own looot account with current data, billed per call.

## Verify a download

Paste the SHA-256 from a release page and check your file matches.

## Test webhook signatures

Compute an HMAC-SHA256 with your test secret to match a signature header.

## Dedupe records

Hash a row or a document to get a stable key for spotting repeats.

## Cache keys

Make a short, fixed-length key from a long prompt or URL.

## How do I generate a SHA-256 hash?

Type or paste the text, or pick a file. The SHA-256 appears with the other four hashes as soon as you type. Text is read as UTF-8, the same as echo -n text | shasum -a 256.

## How do I check a file's checksum?

Pick the file with Hash a file, then paste the checksum from the download page into the compare box. The matching algorithm is highlighted, or the page says nothing matches.

## What is HMAC?

A hash that also takes a secret key, defined in RFC 2104. Webhook providers sign each request with an HMAC so you can check it came from them. Turn on HMAC, enter the key, and compare with the signature header.

## Is MD5 or SHA-1 still safe?

Not for security. Practical collisions exist for both, so never use them for signatures or certificates. They still work as checksums against accidental corruption, which is why the page labels them checksums only.

## Can I hash passwords here?

Do not store passwords with any of these hashes. They are built to be fast, which makes guessing fast too. Use bcrypt, scrypt or Argon2 with a salt.

## Hex or Base64: which do I need?

Hex is the usual form for checksums and git. Base64 is shorter and common in HTTP headers, such as Content-Digest and many webhook signatures. Both hold the same bytes.

## How large a file can I hash?

Up to 200 MB. The file is read into memory in your browser, so very large files need a command line tool such as shasum or certutil.

## Is my text or file uploaded?

No. SHA hashes run on the browser's Web Crypto API and MD5 runs in page code. Nothing leaves your machine.

## Related tools

- /free-tools/base64-encoder-decoder
- /free-tools/jwt-decoder
- /free-tools/uuid-generator

## Last reviewed

2026-10-14.