Verify a download in seconds
Software sites publish a checksum - usually SHA-256 - next to each download so you can confirm the file was not corrupted or tampered with. Choose the downloaded file, paste the published value into the verify box, and the matching hash lights up. Files are hashed on your device and never uploaded, so this works for private files too.
Which algorithm should I use?
SHA-256 is the default for checksums, file integrity and most modern systems. SHA-512 is just as secure and faster on 64-bit machines. MD5 and SHA-1 are broken for security - collisions can be manufactured - but are still used as checksums, which is why they are here. Never use any of these alone to store passwords; use a password hashing function such as bcrypt or Argon2.
HMAC signatures
An HMAC combines a hash with a secret key. Webhooks from Stripe, GitHub and Shopify sign their payloads with HMAC-SHA256 so you can check a request really came from them. Turn on HMAC, enter the secret and paste the exact request body to reproduce the signature they send.
Exactly the same input always gives the same hash - including spaces and line breaks, so a trailing newline changes everything. Encoding rather than hashing? Use Base64 encode / decode, and for new secrets the password generator.