#️⃣ Hash Generator

Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums for text or for a file. Files are read locally by your browser and never uploaded — you can safely hash a private document. Paste a published checksum into the verify box to confirm a download arrived intact.

Input

Text to hash

File to hash

Read locally in your browser. Large files are hashed in chunks and may take a moment.

Verify against a known hash (optional)

Enter text or choose a file, then click "Calculate hashes".

The five digests you get back

Every calculation returns all five at once, as lowercase hex. SHA-1 through SHA-512 come from the browser's own WebCrypto engine; MD5 is computed by a small routine in the page, because WebCrypto deliberately does not offer it.

text "hello"
MD5      5d41402abc4b2a76b9719d911017c592                  32 hex chars
SHA-1    aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d          40
SHA-256  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  64

SHA-384 and SHA-512 add 96 and 128 characters. There is no SHA-3, HMAC or bcrypt here, and text is hashed as its UTF-8 bytes.

Verifying a download

Paste the published checksum into the verify box. It is lower-cased and stripped of spaces first, then compared against all five results, so you do not have to know which algorithm the site used - the matching row is highlighted and named.
Files never leave the machine. Choosing File reads the bytes locally, in one pass into memory, and hashes them in the page. Nothing is uploaded, though a multi-gigabyte image can still exhaust the tab's memory.

A checksum only proves the bytes match what the publisher listed. If an attacker can change the download, they can usually change the checksum beside it - a signature is what proves origin.

Frequently asked questions

Why does my hash differ from the one my terminal printed?

Usually a trailing newline. echo hello | md5sum hashes six bytes and gives b1946ac92492d2347c6235b4d2611184, while the text "hello" hashed here is five bytes and gives 5d41402abc4b2a76b9719d911017c592. Use printf, or hash the file itself.

Are MD5 and SHA-1 still safe to use?

Not against a deliberate attacker. Collisions for both have been produced - two different files with the same digest - so they are only appropriate for spotting accidental corruption or matching a legacy published checksum. Use SHA-256 for anything security-related.

Can I hash a password with this?

You can, but you should not store the result. Plain SHA-256 is far too fast: a commodity GPU tries billions of guesses a second. Password storage needs a slow, salted algorithm such as bcrypt, scrypt or Argon2.