---
title: "Hash generator"
canonical: "https://devtools.nicxon.tech/tools/hash-generator/"
source: "https://devtools.nicxon.tech/tools/hash-generator/"
generator: devtools.nicxon.tech
---

# Hash generator

> Compute MD5, SHA-1, SHA-256, and SHA-512 digests of text or a file, with hex and Base64 output.

## What this does

A cryptographic hash turns any input into a fixed-size digest. The same
 input always produces the same digest; changing a single bit changes about
 half the output bits. This tool computes four digests at once — MD5 (128
 bit), SHA-1 (160 bit), SHA-256, and SHA-512 — over UTF-8 text or the raw
 bytes of a file. SHA functions use the browser's
 [SubtleCrypto](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest)
 implementation; MD5 uses a bundled library because SubtleCrypto doesn't
 provide it.

Files are read locally with the `File` API and never uploaded,
 so you can fingerprint a private document or a build artifact without it
 leaving your machine.

## When you'd use it

- Verifying that a downloaded ISO, binary, or archive matches the checksum the publisher listed.
- Confirming two files are byte-for-byte identical without diffing them.
- Generating an `ETag`-style fingerprint or a cache key for a piece of content.
- Reproducing a hash that another tool or language produced, to debug a mismatch.
- Checking a value against a legacy system that still stores MD5 or SHA-1 digests.

## Worked example

Hash the text `hello` (no newline), lowercase hex:

```
MD5      5d41402abc4b2a76b9719d911017c592
SHA-1    aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-256  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-512  9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043
```

Run `printf 'hello' | sha256sum` on any Linux box and you get
 the same SHA-256 value — a quick way to confirm this tool and your shell
 agree. Add a trailing newline (`echo hello` instead of
 `printf`) and every digest changes completely, which shows why a
 stray newline is a common cause of "the hash doesn't match".

## Limits and gotchas

- **MD5 and SHA-1 are not collision-resistant.** Use them only for compatibility, never to guard against a motivated attacker.
- **Text is hashed as UTF-8.** A system that hashes the same characters as UTF-16 or Latin-1 will get a different digest.
- **Trailing whitespace and newlines count.** They are part of the input.
- **Not a password hash.** Storing user passwords needs a slow, salted function such as bcrypt, scrypt, or Argon2 — a raw SHA digest is unsuitable.
- **Large files** are read into memory before hashing; extremely large files can exhaust the tab.

## How to use

- **Enter text or choose a file** — Type or paste text, or click "Hash a file instead" to hash a file from your device.
- **Pick an output encoding** — Lowercase hex is the default and matches most command-line tools. Uppercase hex and Base64 are also available.
- **Read all four digests** — MD5, SHA-1, SHA-256, and SHA-512 are computed together and shown in a table.
- **Copy the one you need** — Each row has its own copy button. Compare against a published checksum to verify a download.

## Frequently asked questions

### Which hash should I use?

For integrity checks and general use, SHA-256. Use SHA-512 if a spec calls for it. MD5 and SHA-1 are here only for compatibility with old systems and published legacy checksums — do not use them where an attacker could try to engineer a collision, because practical collision attacks exist for both.

### My file's hash doesn't match the one on the download page.

Check three things: that the download completed (a truncated file hashes differently), that you are comparing the same algorithm (a SHA-256 sum won't match a SHA-1 sum), and that you didn't hash the wrong file. If the site offers a signature (.asc) as well as a checksum, the signature is the stronger check.

### Is hashing the same as encrypting?

No. A hash is one-way — you cannot recover the input from the digest — and has no key. Encryption is reversible with a key. Hashes are for integrity and fingerprinting; they are not a way to hide data. A short or low-entropy input can often be recovered by brute force regardless.

### Why is there no MD5 in the browser's built-in crypto?

The Web Crypto API (SubtleCrypto.digest) deliberately omits MD5 because it is broken for security purposes. This tool computes SHA-1/256/512 with SubtleCrypto and MD5 with a small bundled JavaScript implementation, so the MD5 row is there when you genuinely need it for a legacy checksum.

---
*Source: [https://devtools.nicxon.tech/tools/hash-generator/](https://devtools.nicxon.tech/tools/hash-generator/) — generated by devtools.nicxon.tech.*