Hash Generator

How to generate a hash or check a checksum

1. Leave the input on Text and type or paste, or switch to File and choose a file from your device.
2. The MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests appear together in the table, each with its own Copy button. Tick Uppercase if the place you paste into expects capital hex letters.
3. To verify a download, paste the checksum published by its author into Verify a checksum. You don’t need to say which algorithm it is: the matching row turns green and the message names the algorithm. Letter case and surrounding spaces are ignored.

Files are read and hashed by your browser itself rather than sent to a server, so checking a large installer or a confidential document takes no upload time and exposes nothing. Very large files are loaded into memory in one piece, so a multi-gigabyte disk image may be slow on a phone.

What a hash is

A cryptographic hash function turns any input – a word, a contract, a 4 GB video – into a fixed-length fingerprint. The same input always produces the same digest, any change produces a completely different one, and there is no practical way to work backwards from the digest to the input. Hashing is therefore not encryption: there is no key and nothing to decrypt.

The length of a published checksum tells you the algorithm: 32 hex characters is MD5, 64 is SHA-256, and so on.

Worked examples

• hello → SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, MD5 5d41402abc4b2a76b9719d911017c592.
• Hello, with a capital H, → SHA-256 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969. One changed letter, an unrelated result.
• The quick brown fox jumps over the lazy dog → MD5 9e107d9d372bb6826bd81d3542a419d6. Add a full stop at the end and it becomes e4d909c290d0fb1ca068ffaddf22cbd0.
• Even empty input has a digest: SHA-256 e3b0c442…b855. This page leaves the table blank until you type, but if that value turns up in your own logs or database, something hashed an empty string.

Why your hash doesn’t match the command line

Text is hashed as UTF-8 bytes, exactly as typed. Differences almost always come from invisible bytes:

• Trailing newline. echo hello | sha256sum hashes hello plus a line break and prints 5891b5b5…6be03. Use printf %s hello or echo -n hello to get the same digest as this page.
• Line endings. A file saved on Windows ends its lines with CR LF; text pasted into a browser box uses LF only. To check a file, hash the file itself in File mode rather than pasting its contents.
• Character encoding. café encoded as UTF-8 has the MD5 07117fe4a1ebd544965dc19573183da2; the same word in the old Latin-1 encoding gives 961f50f6282239d09e48f812c1ca7276.

For files, the results are identical to sha256sum file on Linux, shasum -a 256 file on macOS and Get-FileHash file in Windows PowerShell (which uses SHA-256 by default).

MD5 and SHA-1 are not for security

A secure hash must make it infeasible to find two different inputs with the same digest (a collision). Practical collisions were published for MD5 in 2004 and for SHA-1 in 2017, which means an attacker can prepare two files that share a checksum. They are still adequate for detecting accidental damage, such as a truncated download, but for anything an adversary might tamper with, use SHA-256 or longer.

None of these functions should be used to store passwords. They are designed to be fast, so a stolen table of password hashes can be tested against billions of guesses per second on ordinary graphics cards. Password storage needs a slow, salted algorithm built for the job, such as Argon2id, scrypt or bcrypt. If what you need is a strong password in the first place, try the password generator.

FAQ

Can a hash be decrypted or reversed?

No. Websites that claim to “decrypt MD5” look the digest up in huge tables of previously hashed common words. That works for hello, not for a random 20-character string.

Which algorithm should I pick for my own checksums?

SHA-256. It is supported everywhere, short enough to paste, and has no known practical attacks. Publish the algorithm name next to the value.

Does a matching checksum prove a file is safe?

It proves your file is byte-for-byte the one the checksum was made from. If an attacker controls the website, they can replace both the file and the checksum, so prefer checksums from a separate trusted source or a signed release.

Why does the page say it needs a secure (https) page?

The SHA algorithms come from the browser’s Web Crypto API, which only works on secure connections. MD5 is computed by the page’s own code, so it is shown even then.