Generate SHA-256 and MD5 hashes on a Mac
A hash generator that runs on a website is asking you to send it the thing you are hashing. That is often a password, a token, or a file you are checking precisely because you do not trust its origin.
Which algorithm still means something
- MD5 — broken for security since 2004. Collisions are trivial to produce. Still fine as a non-adversarial checksum, and still what many vendors publish.
- SHA-1 — broken in practice since 2017. Git uses it for object naming, which is not a security claim. Do not use it for signatures.
- SHA-256 — the current default for integrity and signing. Use this unless something requires otherwise.
- SHA-512 — same family, longer digest, and often faster on 64-bit hardware.
Hashing is not encryption
A hash is one-way: there is no key and no way back. Encryption is reversible by design and requires a key. Confusing the two leads to the common mistake of hashing something that needs to be recovered later, and to the equally common one of storing passwords with a plain fast hash.
Why passwords need a different tool
SHA-256 is designed to be fast, which is exactly wrong for passwords: fast means an attacker with a stolen database can try billions of candidates per second. Password storage needs a deliberately slow, salted algorithm — bcrypt, scrypt or Argon2 — not a general-purpose hash.
A hash tool is the right instrument for verifying a download or fingerprinting content, and the wrong one for building authentication.
Verifying a download
The usual reason to reach for this: a vendor publishes a checksum, and you want to know the file you received is the file they released. Compare the two strings — and be aware that if an attacker can replace the file, they can often replace the published checksum on the same page too. The check is worth most when the checksum comes from somewhere the file did not.
shasum -a 256 ~/Downloads/some-installer.dmgmacOS ships shasum, so a file on disk needs no extra tool at all.
How to check the claim rather than trust it
Bellows is signed without a network entitlement. That is not a policy someone wrote down — it is a permission the binary does not have, and macOS enforces it whether the app wants to connect or not. You can read the entitlements it was signed with:
codesign -d --entitlements - /Applications/Bellows.appNeither com.apple.security.network.client nor com.apple.security.network.server appears in the output. Without them the sandbox refuses to open a socket.
Hash Generator is one of 41 tools in Bellows
A native Mac app that ships with no network entitlement, so macOS blocks it from connecting at all. One-time purchase, every future update included.
What Bellows is →Questions
Is MD5 still safe to use?
Not for anything security-related — collisions can be produced on a laptop. It remains acceptable as a checksum against accidental corruption, which is why vendors still publish MD5 sums.
Should I hash passwords with SHA-256?
No. SHA-256 is fast by design, which helps an attacker brute-force a stolen database. Use bcrypt, scrypt or Argon2, all of which are deliberately slow and salted.
How do I get the SHA-256 of a file on a Mac?
shasum -a 256 filename in Terminal. Bellows hashes pasted text, which is the case Terminal handles less conveniently.