Hash Generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text or files.
| Algorithm | Digest | |
|---|---|---|
| Enter some text to see its hashes | ||
What a hash is
A cryptographic hash turns any input — three characters or a three-gigabyte disk image — into a fixed-length fingerprint. The same input always produces the same digest, and changing a single bit produces a completely different one. Hashes are one-way: there is no operation that recovers the original data from the digest.
That makes them the standard way to answer one question: is this byte-for-byte the file I expected? Download a release, hash it, compare against the checksum on the project's site, and a corrupted transfer or a tampered mirror shows up immediately.
Which algorithm should you use?
- SHA-256 — the default for anything new. Fast, widely supported, and considered secure. Use it unless something forces another choice.
- SHA-512 — a larger digest, and often faster than SHA-256 on 64-bit hardware. Good for long-lived signatures.
- SHA-1 — broken for security since practical collisions were demonstrated in 2017. Still fine as a non-security identifier, which is why Git used it, but never for signatures or certificates.
- MD5 — thoroughly broken; collisions can be produced in seconds. Acceptable only as a checksum against accidental corruption, or when an existing system demands it.
None of these belong anywhere near password storage. They are designed to be fast, which is exactly wrong for passwords. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted.
How to use it
- Type text, or switch to File and drop in a download you want to verify.
- All five digests are computed at once — copy whichever one you need.
- To check a download, paste the vendor's published checksum into the verify box. The matching algorithm is detected from its length and you get a clear match or mismatch.
Frequently asked questions
Is my file uploaded to compute the hash?
No. Hashing runs in your browser via the Web Crypto API, and the file never leaves your machine. Many checksum sites do upload — which is a genuine problem when the file is a private backup or a signed installer.
How big a file can it handle?
Files are read into memory in one pass, so a few hundred megabytes works comfortably on a desktop browser. Multi-gigabyte images are better hashed with shasum -a 256 on macOS and Linux or certutil -hashfile on Windows.
Why does the same text give a different hash elsewhere?
Almost always a trailing newline or a different character encoding. Hashing hello and hello\n gives entirely unrelated digests, and command-line echo adds that newline unless you pass -n. Text here is hashed as UTF-8 with no added characters.
Can two files share a hash?
Mathematically yes — there are infinitely many inputs and finitely many digests. In practice, finding a SHA-256 collision is far beyond current computing. For MD5 and SHA-1 it is not: collisions have been produced deliberately, which is precisely why they are unsuitable for security.
Can I get the original text back from a hash?
No. Hashing is one-way. Sites claiming to “decrypt MD5” simply look the digest up in a table of pre-computed common inputs, which works for password123 and for nothing else.