JPKCom DB

Hash Generator — Examples

Hands-on walkthroughs with the Hash Generator: hash text live, verify downloads, identify hashes, HMAC, an SRI attribute, and a bcrypt hash for PHP.

Back to the overview: Hash Generator · Open the tool live: www.jpkc.com/tools/hash/

The manual explains every algorithm and option in detail. This page adds concrete workflows. The hash values below are the real values for the inputs shown — feel free to reproduce them as a check.

Example 1: Hash one text across several algorithms

You want to see how the same text comes out in different algorithms.

  1. Open the Hash Generator, Text tab, and type hello into the Input field. The info line below it reads "5 bytes".
  2. The table on the right fills right away with all 20 algorithms. In the Legacy group, MD5 shows:
    5d41402abc4b2a76b9719d911017c592
  3. Directly below is SHA-1 — a longer value:
    aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
  4. In the SHA-2 group, SHA-256 delivers 64 hex characters:
    2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
  5. The Copy button at the end of a row puts exactly that value on your clipboard.

Observation: same input, completely different hashes — and the "bigger" the algorithm, the longer the value. Change a single character (hello → Hello) and every row changes completely at once; MD5 is now 8b1a9953c4611296a827abf8c47804d7 (the so-called avalanche effect).

Need the values in a different format? Set Output to Base64. SHA-256 of hello then reads LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=.

Example 2: Verify the integrity of a download

The most common real-world case — matching a downloaded image or archive against the value the vendor published.

  1. The vendor publishes, say, a SHA-256 checksum for its file (often on the download page or in a .sha256 file).
  2. Switch to the File tab. Under Algorithms for files, make sure SHA-256 is selected (it is by default).
  3. Copy the published checksum into the field "Paste the published checksum to verify the download…". You can also paste the whole line from the .sha256 file (<hash> filename.iso) — the tool only takes the hash.
  4. Drag your downloaded file onto the drop area (or click it and pick the file). Hashing starts right away; the bar shows progress, throughput, and time remaining.
  5. If the SHA-256 row turns green and "Match: SHA-256" appears above the table, the file is unchanged and complete. If the tool reports "No algorithm produces this hash", the download is corrupted or tampered with — don't use it, download it again.

The order of steps 3 and 4 doesn't matter: paste the checksum after hashing and the tool checks it against the finished table immediately. If the vendor only publishes MD5, SHA-1, or SHA-512, it works the same way, as long as that algorithm is selected (for where MD5 stands, see the tips).

Example 3: Compare two hashes safely

Sometimes you have a hash and want to know whether it belongs to a particular input — or which algorithm produced it.

  1. In the Text tab, type the original text into the Input field, e.g. hello.
  2. Paste the other value into the field "Paste an expected hash to compare…", for instance in upper case:
    2CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B9824
  3. The tool reports "Match: SHA-256" and highlights the row in green. Upper or lower case makes no difference, and the Base64 form LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ= produces the same match.

The same works for files: hash two files one after the other in the File tab, and on the second run paste the SHA-256 of the first into the compare field. If the two are bit-for-bit identical, the row turns green — no matter how similar or different the files look.

Example 4: Create an HMAC with a key

For API signatures or webhooks you need an HMAC — a hash that additionally depends on a secret key.

  1. Enter your message content in the Input field — for this test, hello.
  2. Enter your secret key in the HMAC key field and leave the encoding next to it on Text — for this test, secret. If you don't have a key yet, click the dice button: it generates a random 256-bit key locally as hex and switches the encoding to Hex.
  3. The table now shows HMACs; the rows carry an HMAC badge. Under SHA-256 you'll find HMAC-SHA-256, the de-facto standard for signatures:
    88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b
  4. Copy at the end of the row copies the value. If the other side expects Base64, switch Output.

Important: the same key + the same message always yield the same HMAC. The recipient can recompute it with the same key and thereby verify that the message is genuine and unchanged. To check a signature you've received, paste it into the compare field — if it's valid, the tool reports "Match: SHA-256 (HMAC)".

Example 5: Try SHA-3 — the more modern standard

You want to use the modern standard from FIPS 202 — and see how it differs from Keccak.

  1. Type hello into the Input field.
  2. In the SHA-3 (FIPS 202) group, SHA3-256 shows:
    3338be694f50c5f338814986cdf0686453a888b84f424d792af4b9202398f392
  3. Further down in the same group is Keccak-256 — same length, but a completely different value, because the original Keccak pads differently:
    1c8aff950685c2ed4bc3174f3472287b56d9517b9c948127319a09a7a36deac8

If a specification asks for "SHA-3", use the SHA3 row; if you're dealing with Ethereum, use the Keccak row (the tooltip says "original Keccak, as used by Ethereum"). In the File tab, SHA3-256 is preselected; switch on other SHA-3 or Keccak variants under Algorithms for files.

Example 6: Process a large file

You want the checksum of a large archive or ISO image.

  1. In the File tab, under Algorithms for files, deselect everything you don't actually need — keep only SHA-256, for example. Every extra algorithm costs time on big files.
  2. Drag the file onto the drop area. There's no fixed size limit: the tool reads the file in chunks instead of loading it into memory in one piece.
  3. The progress bar shows percentage, throughput, and estimated time remaining. The page stays usable in the meantime because the work happens in a background thread. Cancel stops the run.
  4. At the end, the info line reports the duration ("hashed in X s"). Since everything is computed locally in the browser, the file never leaves your machine — the decisive difference from online services that upload your file first.

Example 7: Generate an SRI attribute for a script

You're embedding a JavaScript library from a CDN and want the browser to run it only if its content is exactly right.

  1. Download the file you want to embed.
  2. In the File tab, additionally switch on SHA-384 under Algorithms for files and drag the file onto the drop area.
  3. Below the table, an SRI line appears with sha384-…. The Copy button next to it copies the complete attribute pair.
  4. Insert it into your tag:
    <script src="https://cdn.example.com/lib.min.js"
        integrity="sha384-…" crossorigin="anonymous"></script>

The SRI line only appears without HMAC: if the HMAC switch is on in the File tab and a key is entered in the Text tab, it's missing.

Example 8: Create and verify a bcrypt hash for PHP

You need a password hash for a test account that PHP's password_verify() will accept.

  1. Switch to the Password hashing tab (reachable directly via https://www.jpkc.com/tools/hash/#password).
  2. Leave Algorithm on bcrypt, Cost on 12, and Prefix on $2y$ (PHP).
  3. Enter the password under Password and click Hash password. After a short, deliberately slow computation, a string of the form $2y$12$… appears along with a copy button. The info line reports the duration.
  4. To double-check, copy the hash into Stored hash on the right, enter the same password, and click Verify: "The password matches this hash." With a different password the answer is "The password does NOT match this hash."

Click Hash password a second time and you get a different string — every run uses a new random salt, and both hashes still match the same password. For a new project you can pick Argon2id (recommended) instead; PHP understands those strings too. For a Django database, choose PBKDF2-HMAC-SHA256 (Django format).

Example 9: Hash raw bytes given as hex

You don't have text but bytes — from a hex dump, a protocol capture, or a table of test vectors.

  1. Switch the selector above the Input field from Text (UTF-8) to Hex bytes.
  2. Paste the bytes. Separators such as spaces, :, or 0x prefixes don't get in the way, for example:
    68 65 6c 6c 6f
  3. The info line reads "5 bytes", and SHA-256 is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 — the same five bytes as hello in Example 1.

If the input isn't valid hex (a g, or an odd number of digits), the info line shows the error in red. For Base64-encoded data, choose Base64 bytes.

Go deeper: the overview for the big picture, the manual for every algorithm, and the tips & tricks for the security context. You can try everything directly in the tool.