Hash Generator — MD5, SHA-1, SHA-256 & SHA-512 online
Generate MD5, SHA-1, SHA-256 and SHA-512 checksums from text or a file using the browser Web Crypto API. Free, instant, and nothing is ever uploaded.
About the Hash generator tool
A hash is a fixed-length fingerprint computed from data of any size. The same input always produces the same hash, a change of a single bit produces a completely different one, and the process cannot be run backwards to recover the original. That combination makes hashes the standard way to answer one question quickly and definitively: is this data exactly what it is supposed to be?
The everyday use is verifying a download. Projects publish a SHA-256 checksum next to their installers so you can confirm the file you received is the file they released — not one truncated by a failed transfer, and not one substituted somewhere along the way. Comparing the two strings takes seconds and is the only reliable way to know, since a corrupted or tampered file usually looks entirely normal.
Which algorithm to use is largely settled. SHA-256 is the current default for anything that matters, with SHA-512 available where a longer digest is wanted. MD5 and SHA-1 are both cryptographically broken — researchers can construct two different files with the same MD5 in seconds, and SHA-1 collisions have been demonstrated in practice — so neither should be trusted to prove authenticity. They remain useful only as non-security checksums, and only where a legacy system requires them.
One thing hashes are not is a way to store passwords by themselves. A plain SHA-256 of a password is computed so fast that an attacker with the hash can try billions of guesses per second. Password storage needs a deliberately slow algorithm with a per-user salt — bcrypt, scrypt or Argon2 — which is a different tool for a different job, and using a general-purpose hash instead is a well-known and serious mistake.
How it works
Provide the input
Type or paste text, or drop in a file. Files are read from disk and never uploaded anywhere.
Pick an algorithm
SHA-256 for anything security-related, SHA-512 for a longer digest, MD5 or SHA-1 only when a legacy system demands it.
Compare the result
The hash appears immediately. Match it against the published checksum — they should be identical character for character.
Frequently asked questions
- Which algorithm should I use?
- SHA-256 unless something specific requires otherwise. It is the modern standard, widely supported and not known to be broken. SHA-512 is equally sound and produces a longer digest. MD5 and SHA-1 are broken for security purposes and should only be used to match a checksum published by an older system that offers nothing better.
- Why are MD5 and SHA-1 considered broken?
- Because collisions can be constructed deliberately — two different inputs producing the same hash. For MD5 this takes seconds on ordinary hardware, and SHA-1 collisions were demonstrated publicly in 2017. That destroys their value for proving a file is authentic, since an attacker can craft a malicious file matching the checksum of a legitimate one.
- Can a hash be reversed to get the original data?
- Not by computation — hashing discards information and is designed to be one-way. What is possible is guessing: hashing enormous lists of likely inputs and looking for a match. That is exactly how leaked password hashes are cracked, and it is why short or common inputs offer no protection at all when hashed with a fast algorithm.
- Should I use this to hash passwords?
- No. General-purpose hashes are built to be fast, which is precisely wrong for passwords — speed is what lets an attacker test billions of candidates per second against a stolen database. Password storage requires a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2, handled server-side by your authentication framework.
- How do I verify a downloaded file?
- Drop the file in, choose the algorithm the publisher used — usually SHA-256 — and compare the result with the checksum on their download page, character for character. If they match, the file is intact and unmodified. If they differ at all, discard it and download again; a partial match means nothing.
- Is my file uploaded to be hashed?
- No. Hashing uses the browser's built-in Web Crypto API, so the file is read from your disk and processed in memory inside the tab. Nothing is transmitted or stored. This also means there is no size limit imposed by any server — large files simply take a moment longer to read.
- Why does the same text give a different hash elsewhere?
- Almost always an encoding or whitespace difference. Text is hashed as UTF-8 bytes here, and a tool using a different encoding will produce a different digest for the same visible characters. A trailing newline is the other frequent culprit — hashing a file that ends with one is not the same as hashing the text without it.