How to use the hash generator
- 1Choose Hash: Text or File, and tick the Algorithms you need (MD5, SHA-1, SHA-256 and SHA-512 are on by default).
- 2Type or paste text into Text to hash, or choose a file. Text hashes update as you type; file hashes show a progress bar.
- 3Pick an Output format (lower-case hex, upper-case HEX or Base64) and press Copy next to the hash you need.
- 4To verify a download, paste the published checksum into Compare with a checksum. A matching row is highlighted and the panel says Match or No match.
Example
hello world
MD5 5eb63bbbe01eeed093cb22bb8f5acdc3 SHA-1 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed SHA-256 b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
11 bytes of UTF-8. Adding a line break at the end (as many editors do) gives completely different hashes.
Choosing an algorithm
| Algorithm | Length | Status | Use it for |
|---|---|---|---|
| MD5 | 128 bits, 32 hex | broken (collisions in seconds) | matching old checksums, cache keys |
| SHA-1 | 160 bits, 40 hex | broken for signatures (2017) | Git object IDs, legacy systems |
| SHA-256 | 256 bits, 64 hex | secure | file checksums, signatures, APIs |
| SHA-384 | 384 bits, 96 hex | secure | TLS, Subresource Integrity |
| SHA-512 | 512 bits, 128 hex | secure | as SHA-256; faster on 64-bit CPUs |
SHA-1 and the SHA-2 family (SHA-256/384/512) are defined in FIPS 180-4 and computed with your browser's Web Crypto API. MD5 isn't in Web Crypto, so this page uses its own RFC 1321 implementation, labelled not for security. When you have a choice, use SHA-256.
Hashing files and verifying checksums
Software downloads often publish a checksum next to the file, such as SHA256: 9f86d0…. After downloading, choose the file here and paste the published value into Compare with a checksum. If the hashes are identical, the file is byte-for-byte what was published; if not, it was corrupted or replaced.
The file is read on your device and never uploaded, so this works for private documents too. The comparison ignores case, spaces and colons, accepts Base64, and works out the algorithm from the checksum's length. On the command line the same check is sha256sum file (Linux), shasum -a 256 file (macOS) or Get-FileHash file (PowerShell).
Hashing vs encryption vs encoding
- A hash is a fixed-length fingerprint. The same input always gives the same hash, any change gives a completely different one, and there is no way back from the hash to the input.
- Encryption is reversible with a key: it hides data so only the key holder can read it.
- Encoding such as Base64 is reversible by anyone; it only changes the representation.
HMAC (RFC 2104) mixes a secret key into the hash. GitHub and Shopify, for example, sign webhook payloads with HMAC-SHA256 of the raw request body: compute the HMAC of the exact body with your signing secret and compare it with the signature header. (Stripe signs the timestamp, a dot and the body, so prepend those first.) Tick HMAC (keyed hash) to do that here.
Why MD5 and SHA-1 aren't safe for passwords
MD5, SHA-1 and SHA-256 are all designed to be fast: a single graphics card computes billions of them per second. That is good for checksums and fatal for passwords, because an attacker who steals a table of hashed passwords can try every common password in minutes. Unsalted MD5 hashes of common passwords can simply be looked up online.
Store passwords with a deliberately slow, salted algorithm made for the purpose: Argon2id, scrypt or bcrypt, as OWASP recommends. MD5 and SHA-1 also have practical collision attacks (two different inputs with the same hash), so don't use them for signatures or certificates either.
Is anything I enter stored?
This tool runs entirely in your browser. Your text is not uploaded to our servers.