本文へスキップ
DevTools / ハッシュ生成ツール

ハッシュ生成ツール

Generate cryptographic and checksum hashes from any text or file without sending a single byte to a server. The tool covers the full set developers actually reach for — MD5 and CRC32 for legacy checksums, SHA-1 for older signatures, SHA-256/384/512 for modern integrity work, and HMAC-SHA256 for keyed message authentication. Text is hashed live as you type; files are streamed in 4 MB slices so a multi-gigabyte archive hashes in constant memory.

すべてブラウザ内で実行 — 何もアップロードされません。

0 characters · 0 bytes (UTF-8)

結果
まだ表示する内容がありません

Hash a local file

またはここにファイルをドロップ

Files are streamed in 4 MB slices and never uploaded.

仕組み

SHA-256 belongs to the SHA-2 family designed by the NSA and published by NIST in 2001. It pads the input, splits it into 512-bit blocks and runs 64 rounds of a compression function built from bitwise rotations, modular addition and a fixed set of round constants derived from the cube roots of the first 64 primes. The result is a 256-bit digest — 64 hexadecimal characters — with the avalanche property that flipping one input bit changes roughly half the output bits.

MD5 and CRC32 are included for compatibility, not for security. MD5 produces a 128-bit digest and has been collision-broken since 2004; CRC32 is a 32-bit cyclic redundancy check designed purely to detect transmission errors. Both remain in active use for S3 ETags, ZIP entries, PNG chunks, cache-busting filenames and legacy API signatures, which is why they are still worth having in a toolbox. HMAC-SHA256 instead wraps SHA-256 with a secret key, so the digest proves both integrity and possession of the key — the mechanism behind AWS SigV4, Stripe webhooks and JWT HS256 tokens.

Everything here executes locally through the Web Crypto API, plus compact JavaScript implementations of MD5 and CRC32 that the browser does not provide natively. The file path uses File.slice() to read the file in 4 MB chunks, feeding each one into a streaming hasher, so memory use stays flat regardless of file size. No part of the input is ever transmitted — you can verify this by opening your browser's network panel while the digest is computed.

主な利用シーン

  • Verify a downloaded ISO or release archive against the checksum published by the vendor.
  • Generate an S3-style ETag or Content-MD5 header for an object upload.
  • Produce an HMAC-SHA256 signature to debug a webhook verification failure.
  • Create a cache-busting fingerprint for a static asset filename.
  • Check whether two large files are byte-identical without diffing them.
  • Compute the CRC32 of an asset when building a ZIP or PNG chunk by hand.

最終更新: 2026-10-14 — 本文は英語で表示されます（UI は翻訳済み）。

よくある質問

Is SHA-256 reversible?

No. A cryptographic hash is a one-way function: there is no key and no inverse operation, so a digest cannot be turned back into the original input. The only realistic attack is brute force — trying candidate inputs and comparing digests — which is exactly why short or guessable passwords fall to rainbow tables and dictionary attacks while long random inputs do not.

What is a rainbow table, and why does salting defeat it?

A rainbow table is a precomputed map from hashes back to the plaintext that produced them. Instead of hashing one guess at a time, an attacker looks the digest up. A salt — a unique random value mixed into each input before hashing — makes every stored digest different even for identical passwords, so a precomputed table is useless and the attacker must fall back to per-target brute force.

MD5 or SHA-256 — which should I use?

Use SHA-256 (or SHA-512) for anything security-relevant: signatures, password storage, integrity checks an attacker might want to forge. Use MD5 only where you need to match an existing system that already uses it, such as an old ETag or a legacy checksum file. MD5 collisions can be generated in seconds on ordinary hardware, so it provides no meaningful security guarantee today.

Do you upload my file or my text to hash it?

No. Hashing happens entirely inside your browser using the Web Crypto API and local JavaScript. Files are read through File.slice() in 4 MB chunks — the browser never sends them anywhere, and the page makes no request while it works. You can confirm this by watching the network panel in your browser's developer tools.

Why is the CRC32 output only 8 characters?

CRC32 produces a 32-bit value, which is exactly 8 hexadecimal characters. It is a checksum, not a cryptographic digest: it reliably catches accidental corruption such as a flipped bit during transfer, but it offers no protection against deliberate tampering because it is trivial to construct a modified input with the same CRC32.

関連ツール