Hash Generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 — for text or any file, all at once. Nothing is uploaded.
The file is read locally with FileReader and hashed in this tab. It is never uploaded — check a private installer or document safely.
Which one should I use?
| Algorithm | Length | Use it for |
|---|---|---|
| MD5 | 128-bit · 32 hex | Legacy checksums and dedup only — collisions are cheap to forge. |
| SHA-1 | 160-bit · 40 hex | Git object ids and old checksums. Broken since 2017; do not start new work with it. |
| SHA-256 | 256-bit · 64 hex | The default. Download verification, signatures, content addressing. |
| SHA-384 | 384-bit · 96 hex | Subresource Integrity and TLS suites that specify it. |
| SHA-512 | 512-bit · 128 hex | Larger margin, and faster than SHA-256 on 64-bit hardware. |
About this tool
A hash is a fixed-length fingerprint of any input. Change one byte and the digest changes completely, which is what makes it useful for spotting a corrupted download, telling two files apart, or proving a payload was not tampered with in transit.
The SHA family here comes from your browser's own Web Crypto implementation — the same native code that verifies TLS certificates. MD5 is not part of Web Crypto (deliberately: it is broken), so it is computed in JavaScript on this page and is kept only because so many older download pages still publish MD5 checksums.
Hashing is not encryption and it is not password storage. It cannot be reversed, but it is also far too fast to protect a password — that needs bcrypt, scrypt or Argon2, which are slow on purpose.
FAQ
Is my text or file uploaded?
No. Hashing happens in your browser using the built-in Web Crypto API, and files are read locally with FileReader. Nothing is sent to a server, so it's safe to check a private document or an installer.
Can a hash be reversed?
No. A hash is one-way: the same input always gives the same digest, but there's no way to compute the input back from it. Sites that claim to "reverse" a hash are looking the value up in a table of already-known inputs, which only works for common strings.
Should I still use MD5 or SHA-1?
Only for non-security checks such as spotting a corrupted download or deduplicating files. Both are broken against deliberate collisions, so never use them for passwords, signatures or anything an attacker can influence. Use SHA-256 for that.
Should I hash a password with this?
No. Plain SHA-256 is far too fast to store passwords with. Password storage needs a slow, salted algorithm designed for it — bcrypt, scrypt or Argon2.
Why do I get a different hash than my terminal?
Almost always a trailing newline. echo hello | sha256sum hashes hello\n, not hello — use echo -n, or add the newline here. Line endings matter too: a file saved with CRLF hashes differently from the same file with LF.