Hash Generator
Type text or choose a file to get its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes. Paste a published checksum to confirm that a download is genuine. Files are hashed in your browser and never uploaded.
0 characters · 0 bytes
How to use the Hash Generator
- Choose Text or File. Type or paste text, or drop a file onto the box.
- Pick the algorithms you need. MD5, SHA-1, SHA-256 and SHA-512 are selected by default.
- Press Generate hashes (text also updates as you type; files start automatically).
- Paste an expected checksum into the matcher to see instantly whether it matches and which algorithm it belongs to.
- Copy any hash, switch to uppercase, or choose Base64 output for things like Subresource Integrity.
Hash algorithms compared
| Algorithm | Output size | Hex length | Status | Typical use |
|---|---|---|---|---|
| MD5 | 128 bits | 32 | Broken (collisions) | Legacy checksums, cache keys, duplicate detection |
| SHA-1 | 160 bits | 40 | Broken (collisions since 2017) | Older Git object IDs, legacy checksums |
| SHA-256 | 256 bits | 64 | Secure | Download checksums, certificates, blockchains |
| SHA-384 | 384 bits | 96 | Secure | Subresource Integrity (SRI), TLS |
| SHA-512 | 512 bits | 128 | Secure | File integrity, often faster than SHA-256 on 64-bit CPUs |
The hex length tells you the algorithm of an unknown checksum at a glance: a 64-character hash is almost certainly SHA-256. The checksum matcher uses this to point you to the right algorithm.
Test vectors: check any hash tool
These are the official values for the three-letter text abc (bytes 61 62 63). Type abc above to see the same results.
| Algorithm | Hash of "abc" |
|---|---|
| MD5 | 900150983cd24fb0d6963f7d28e17f72 |
| SHA-1 | a9993e364706816aba3e25717850c26c9cd0d89d |
| SHA-256 | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
The hash of empty input is also fixed: MD5 d41d8cd98f00b204e9800998ecf8427e and SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. If you see these, the text box or file is empty.
Tips for matching checksums
- Case does not matter for hex:
ABC1andabc1are the same hash. The matcher ignores case and spaces. - Text hashes depend on every byte. "hello" and "hello " (with a trailing space) or a version ending in a newline have completely different hashes.
- Base64 output is used by Subresource Integrity: an
integrityattribute issha384-followed by the Base64 SHA-384 hash of the file. - On the command line you can compare with
sha256sum file(Linux),shasum -a 256 file(macOS) orcertutil -hashfile file SHA256(Windows).
Frequently asked questions
What is a hash?
A hash function turns any input into a fixed-length fingerprint. The same input always gives the same hash, and changing a single character produces a completely different one. Hashes are used to check that files are intact, to find duplicates and to identify data.
Which hash algorithm should I use?
Use SHA-256 or SHA-512 for anything security related. MD5 and SHA-1 are still fine for spotting accidental corruption or matching checksums that a website publishes, but both are broken for security purposes because collisions can be created on purpose.
How do I verify a downloaded file?
Open the File tab, choose the downloaded file and paste the checksum from the publisher's website into the checksum matcher. If it says Match, the file is byte-for-byte identical to the one the publisher hashed.
Why does my text give a different hash in another tool?
Hashes are computed on bytes, so the text encoding and invisible characters matter. This tool uses UTF-8 and hashes exactly what is in the box, including spaces and line breaks. A trailing newline, Windows line endings (CRLF) or a different encoding will change the result.
Can a hash be reversed to get the original text?
No. Hash functions are one-way. Short or common inputs like simple passwords can be found with lookup tables, which is why passwords should be stored with a slow, salted algorithm such as bcrypt or Argon2, not a plain MD5 or SHA hash.
Are my files uploaded?
No. Files are read and hashed locally with JavaScript and the Web Crypto API. Nothing is sent to a server.