How to generate a hash
- Choose Text and type or paste, or choose File and pick any file.
- MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes are calculated instantly. Click any hash to copy it.
- To verify a download, paste the checksum published by the software vendor into the compare box. A matching row turns green.
What is a hash?
A cryptographic hash function turns any amount of data into a fixed-length “fingerprint”. The same input always gives the same hash, but changing even one character produces a completely different result. It is also designed to be one-way: you cannot work out the original data from the hash.
For example, the SHA-256 of Hello, world! is 315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3, while Hello, world. gives an entirely different value.
Which algorithm should I use?
| Algorithm | Length | Status | Use for |
|---|---|---|---|
| MD5 | 128-bit (32 hex) | Broken for security — collisions are easy to create | Non-security checks, legacy systems, cache keys |
| SHA-1 | 160-bit (40 hex) | Deprecated; practical collisions shown in 2017 | Legacy compatibility, Git object IDs |
| SHA-256 | 256-bit (64 hex) | Secure, widely used | File verification, digital signatures, blockchains |
| SHA-384 / SHA-512 | 384 / 512-bit | Secure | Higher security margins, some TLS and government uses |
Verifying downloads
Many software publishers list a SHA-256 checksum next to their downloads. After downloading, hash the file here and compare. If the values match exactly, the file was not corrupted or tampered with on the way. If they differ, delete the file and download it again from the official source.
Hashing is not encryption — and not for passwords
Hashes cannot be “decrypted”. But fast hashes like MD5 and SHA-256 are not suitable for storing passwords: attackers can try billions of guesses per second, and precomputed tables exist for common passwords. Applications should store passwords with slow, salted algorithms designed for the job, such as Argon2, bcrypt or scrypt.
Privacy
Text and files are hashed in your browser — MD5 by a built-in JavaScript implementation and the SHA family by your browser’s Web Crypto API. Large files are read locally and never uploaded.
Frequently asked questions
Can a hash be reversed or decrypted?
No. Hash functions are one-way. “MD5 decrypters” online simply look up common inputs in large precomputed tables.
Is MD5 still safe?
Not for security. MD5 and SHA-1 have known collision attacks. Use SHA-256 or stronger for anything security-related; MD5 is fine for simple integrity checks.
Why does my hash differ from another tool?
Check for invisible differences: a trailing space or newline, different line endings (Windows CRLF vs Unix LF) or text encoding all change the hash. This tool hashes text as UTF-8.
Is there a file size limit?
Files are read into memory, so very large files (several GB) may fail on devices with limited RAM. Files of a few hundred MB work on most computers.