webtools

Hash Generator

Private: nothing leaves your browser

Type or paste something above and every hash appears.

    Get the MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of any text or file at once, and check a download against the checksum its publisher listed. Files are read on your own device and never uploaded, so this works on a 700 MB ISO and works offline.

    Which hash algorithm should you use?

    Algorithm Output length Safe for new work Still seen in the wild for
    MD5 128 bits, 32 hex No. Collisions are made to order Download checksums, non-security IDs
    SHA-1 160 bits, 40 hex No. Publicly broken since 2017 Git object IDs, older release checksums
    SHA-256 256 bits, 64 hex Yes. The default Packages, certificates, signatures
    SHA-384 384 bits, 96 hex Yes TLS suites, subresource integrity
    SHA-512 512 bits, 128 hex Yes Large files on 64-bit machines
    CRC-32 32 bits, 8 hex No, and it never was one Accidental corruption: ZIP, PNG, Ethernet

    MD5 and SHA-1 are broken for anything that turns on nobody being able to forge a match. Two different files can be built to share an MD5 in seconds on a laptop, and the same was demonstrated for SHA-1 in 2017, so neither proves that a file is the file somebody meant to give you. They are still here because comparing a value you did not choose against a value somebody published is a different job: if a download page lists an MD5 and you want to know whether your copy arrived intact, an MD5 is the only thing that can answer, and it answers that correctly. CRC-32 is not a cryptographic hash at all and never claimed to be; it catches a flipped bit, which is exactly what a ZIP archive needs it for.

    About this hash generator

    A hash is a fixed length fingerprint of some data. Change one byte anywhere and the whole fingerprint changes, which is what makes it useful for confirming that a file arrived intact, that two records are identical, or that a cache entry is still the one you stored. The same input always gives the same hash, so the value here will match the value your server computes for the same bytes.

    The SHA hashes come from your browser's built-in cryptography engine, which is why hashing a large file is fast. MD5 and CRC-32 are implemented on the page because no browser exposes them. Nothing is uploaded: choosing a 700 MB file hashes it locally and your network stays idle throughout, which you can confirm in your own developer tools.

    How to hash a file or verify a checksum

    1. Stay on Text to hash something you type or paste. Every algorithm updates as you go.
    2. Switch to File to hash a download, an archive or a disk image.
    3. Press the copy button on the row you need.
    4. To verify a download, paste the checksum from the publisher's page into the compare box. You can paste the whole hash filename line from a .sha256 file: the filename is ignored.
    5. A match is reported with the algorithm that matched, so you also learn which one they published.

    Common questions about hashing

    Does checking a 700 MB download mean uploading it?
    No. The file is read by JavaScript on this page and hashed in memory on your own machine, so nothing is sent. That is a claim worth checking rather than believing, and here you can: open the Network tab of your browser's developer tools and hash a file, and no request appears at all. Then switch your connection off and hash another one, which still works. It is also why this page copes with a file far too large to upload comfortably.

    Which hash should I use?
    SHA-256 for anything new. Use MD5 or SHA-1 only to match a checksum somebody else published, because both are broken: two different files can be made to share an MD5, and the same has been demonstrated for SHA-1. CRC-32 is not a cryptographic hash at all, only an accidental-corruption check, which is what ZIP files use it for.

    Can a hash be reversed back to the text?
    Not by undoing the maths, no. But a short or common input can be found by simply hashing every candidate until one matches, which is why a plain hash is not a safe way to store a password. Password storage needs a slow, salted algorithm such as bcrypt, scrypt or Argon2, not MD5 or SHA-256. If a strong password is what you are actually after rather than a hash of one, the password generator is the page for that.

    Why does my hash differ from the one my server produced?
    Almost always a difference in the bytes, not in the algorithm. A trailing newline, Windows line endings instead of Unix, or a different text encoding all change the input. Text typed here is encoded as UTF-8, with no newline added at the end. Hashing the file itself rather than its contents pasted in avoids the question entirely.

    What is the difference between SHA-256 and SHA-512?
    The length of the output, 64 hex characters against 128, and the word size the algorithm works in. Both are considered sound. SHA-512 is often faster on a 64-bit machine despite producing more output, but SHA-256 is the more widely published of the two, so it is the safer default when somebody else has to check your value.

    Next

    Related tools

    All Dev tools
    UUID Generator Generate v4 UUIDs one at a time or a thousand at once. Base64 Decode Decode Base64 back to text, with full UTF-8 support. Password Generator Strong random passwords with a real strength meter. JSON Formatter Format, validate and minify JSON with clear error positions.