Hash Generator (MD5, SHA-256)
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text or file, and check a download against its published checksum. Hashing runs in your browser, so files are never uploaded.
- MD5
- SHA-1
- SHA-256
- SHA-384
- SHA-512
How it works
- Enter text or pick a fileText is hashed as UTF-8 as you type. Files are read locally, up to 1 GB.
- Get every hashMD5, SHA-1, SHA-256, SHA-384 and SHA-512 appear together, in lowercase or uppercase hex.
- VerifyPaste a published checksum; the tool tells you which algorithm it matches, or that it does not match.
- CopyCopy any hash with one click.
What a hash is
A cryptographic hash function turns any input, from one letter to a multi-gigabyte file, into a short fixed-length fingerprint. The same input always gives the same hash, and changing a single bit changes it completely. That makes hashes ideal for checking that a download was not corrupted or tampered with, detecting duplicate files, and building signatures and caches in software.
Which algorithm to use
- SHA-256: the modern default for checksums, software downloads, Git's optional SHA-256 repositories, blockchains and API signatures.
- SHA-384 and SHA-512: longer outputs from the same SHA-2 family, used in some TLS and signing setups; SHA-512 can be faster on 64-bit processors.
- SHA-1: still seen in older systems and Git, but practical collision attacks exist, so do not use it for security.
- MD5: fine for detecting accidental corruption and for legacy checksums, but broken for security: different inputs with the same MD5 can be created deliberately.
Hashes are not for storing passwords
A plain SHA-256 or MD5 of a password can be cracked quickly with lists of common passwords, because these functions are designed to be fast. Applications should store passwords with a slow, salted password-hashing function such as Argon2id, scrypt or bcrypt. To prove a message came from someone who knows a secret key, use an HMAC; our HMAC Verifier checks webhook signatures that way.
Frequently asked questions
Is my file uploaded?
No. The file is read and hashed by your browser; SHA hashes use the built-in Web Crypto API and MD5 runs in the page.
Why does my hash differ from another tool?
Usually because of invisible differences: a trailing newline, Windows line endings or a different text encoding. This tool hashes exactly the characters in the box as UTF-8.
Can a hash be reversed?
No. Hashes are one-way, although short or common inputs can be found by guessing, which is why they are unsuitable for passwords.
How do I verify a download?
Choose the downloaded file, then paste the checksum from the publisher’s website into the verify box.