Hash generator
Compute MD5, SHA-1, SHA-256, and SHA-512 digests of text or a file, with hex and Base64 output.
What this does
A cryptographic hash turns any input into a fixed-size digest. The same input always produces the same digest; changing a single bit changes about half the output bits. This tool computes four digests at once — MD5 (128 bit), SHA-1 (160 bit), SHA-256, and SHA-512 — over UTF-8 text or the raw bytes of a file. SHA functions use the browser's SubtleCrypto implementation; MD5 uses a bundled library because SubtleCrypto doesn't provide it.
Files are read locally with the File API and never uploaded,
so you can fingerprint a private document or a build artifact without it
leaving your machine.
When you'd use it
- Verifying that a downloaded ISO, binary, or archive matches the checksum the publisher listed.
- Confirming two files are byte-for-byte identical without diffing them.
- Generating an
ETag-style fingerprint or a cache key for a piece of content. - Reproducing a hash that another tool or language produced, to debug a mismatch.
- Checking a value against a legacy system that still stores MD5 or SHA-1 digests.
Worked example
Hash the text hello (no newline), lowercase hex:
MD5 5d41402abc4b2a76b9719d911017c592 SHA-1 aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 SHA-512 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043
Run printf 'hello' | sha256sum on any Linux box and you get
the same SHA-256 value — a quick way to confirm this tool and your shell
agree. Add a trailing newline (echo hello instead of
printf) and every digest changes completely, which shows why a
stray newline is a common cause of "the hash doesn't match".
Limits and gotchas
- MD5 and SHA-1 are not collision-resistant. Use them only for compatibility, never to guard against a motivated attacker.
- Text is hashed as UTF-8. A system that hashes the same characters as UTF-16 or Latin-1 will get a different digest.
- Trailing whitespace and newlines count. They are part of the input.
- Not a password hash. Storing user passwords needs a slow, salted function such as bcrypt, scrypt, or Argon2 — a raw SHA digest is unsuitable.
- Large files are read into memory before hashing; extremely large files can exhaust the tab.
Frequently asked questions
- Which hash should I use?
- For integrity checks and general use, SHA-256. Use SHA-512 if a spec calls for it. MD5 and SHA-1 are here only for compatibility with old systems and published legacy checksums — do not use them where an attacker could try to engineer a collision, because practical collision attacks exist for both.
- My file's hash doesn't match the one on the download page.
- Check three things: that the download completed (a truncated file hashes differently), that you are comparing the same algorithm (a SHA-256 sum won't match a SHA-1 sum), and that you didn't hash the wrong file. If the site offers a signature (
.asc) as well as a checksum, the signature is the stronger check. - Is hashing the same as encrypting?
- No. A hash is one-way — you cannot recover the input from the digest — and has no key. Encryption is reversible with a key. Hashes are for integrity and fingerprinting; they are not a way to hide data. A short or low-entropy input can often be recovered by brute force regardless.
- Why is there no MD5 in the browser's built-in crypto?
- The Web Crypto API (
SubtleCrypto.digest) deliberately omits MD5 because it is broken for security purposes. This tool computes SHA-1/256/512 with SubtleCrypto and MD5 with a small bundled JavaScript implementation, so the MD5 row is there when you genuinely need it for a legacy checksum.