Hash Generator: MD5, SHA-1, SHA-256, SHA-512 Online
Compute MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 of any text or file at once in your browser, in hex or Base64, and compare with an expected hash. Nothing is uploaded.
These are the digests of the empty input.
About the Hash Generator
The Hash Generator computes six cryptographic digests of a text or a file at once: MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512. A hash is a fixed-length fingerprint of data: the same input always gives the same hash, and the smallest change gives a completely different one. Type or paste text, or choose a file of up to 50 MB, and every digest updates as you go. Paste an expected hash into Compare with to check a download or a message. Everything runs in your browser; your text and files are never uploaded.
How to use it
Steps
- Type or paste text, or press Choose file and pick a file. The digests of the empty input are shown until you do.
- Read the digests in the list. Each has its own Copy button.
- Turn on Upper case for capital hex letters, or Base64 to see each digest in Base64 instead of hex.
- To verify a checksum, paste the expected value into Compare with. The page tells you which algorithm it matches, or that nothing matches.
Privacy
Hashing happens entirely in your browser. Your text and files are never uploaded to our servers, and nothing is kept once you close or reload the tab.
Which algorithm to use
MD5 and SHA-1: checksums only
MD5 and SHA-1 are fast and still widely used for checksums, cache keys and compatibility with older systems. Both are broken for security: attackers can produce two different inputs with the same hash. Use them to detect accidental corruption, never to verify that data came from a trusted source or to store passwords.
SHA-256 and the SHA-2 family
SHA-256 is the common choice today: download verification, Git object identity, certificates and blockchains all use it. SHA-224 is a truncated variant, and SHA-384 and SHA-512 are the 64-bit members of the family, faster on modern processors for large inputs and longer in output. All four are computed here, the four Web Crypto algorithms by the browser itself and SHA-224 by a verified implementation in the page.
Not for passwords
A plain hash, even SHA-512, is the wrong tool for storing passwords. Password hashing needs a slow, salted function such as Argon2, scrypt or bcrypt. This tool is for checksums and fingerprints.
Reading the output
- Hex is the default: two characters per byte, so MD5 is 32 characters, SHA-1 is 40, SHA-256 is 64 and SHA-512 is 128. Case does not matter; Compare with ignores it.
- Base64 is shorter and appears in HTTP headers such as
DigestandContent-MD5and in some package manifests. - Text is hashed as UTF-8 bytes without a trailing newline. A hash computed with
echoon a terminal includes the newlineechoadds, so useprintforecho -nto match.
Related tools
Need the bytes of a string before hashing them? See Text to Hex. To encode a digest or any data for a URL or a JSON field, use the Base64 Encoder. For identifiers rather than fingerprints, the UUID Generator makes unique IDs, and the Password Generator makes strong secrets. Go straight to the MD5 hash or SHA-256 hash page if you only need one.
Frequently asked questions
Which hash algorithm should I use to verify a download?
Use SHA-256 when the publisher offers it, since no practical collision attack against it is known. Compare only against a checksum obtained from the official source over a secure connection. MD5 and SHA-1 still detect accidental corruption but cannot prove that a file was not tampered with.
Why are MD5 and SHA-1 described as insecure if they still work?
Both still compute a fingerprint, but researchers can create two different inputs that produce the same MD5 or SHA-1 hash. That makes them useless for signatures and for verifying files from an untrusted source, while they remain fine as checksums against accidental changes and as cache keys.
Why does my terminal give a different hash for the same text?
Most often because echo appends a newline, so the terminal hashes one extra byte. Use printf or echo -n to hash exactly the text. Differences can also come from a different character encoding; this page hashes the UTF-8 bytes of what you typed.
Can I hash a password here to store it?
You should not. Fast hashes such as SHA-256 let an attacker test billions of guesses per second against a leaked database. Passwords need a slow, salted algorithm such as Argon2, scrypt or bcrypt, which this tool deliberately does not provide.
Is my file uploaded to compute its hash?
No. The file is read in your browser and the digests are computed there, the four SHA variants by the browser's Web Crypto API and MD5 and SHA-224 by code on the page. Nothing is sent anywhere and nothing is kept once you close the tab.