Hash Generator
Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, and paste a published checksum to see at once whether your download matches.
Hashed as UTF-8, exactly as typed: spaces and line breaks count. Up to 10,000,000 characters.
—
—
—
—
—
MD5 and SHA-1 are broken for security: different files with the same hash have been made for both. Use them only to check a download against a published checksum. For anything security-related, use SHA-256 or stronger.
Your text and files are hashed on your device and never leave it: nothing is uploaded, sent or saved.
Fingerprints for files and text
A hash function turns any amount of data into a short, fixed-length fingerprint. Change a single byte and the fingerprint changes completely, which makes hashes the standard way to confirm that a download arrived intact, that two files are identical, or that text hasn’t been altered. This tool works out five common hashes at once and checks them against the value you expect.
How to use it
- Choose Text or A file. Text is hashed as you type; a file up to 200 MB is hashed as soon as you choose it.
- Pick how to show the hashes: lowercase hex (the usual form), uppercase hex or Base64.
- Copy one hash or all of them, or download them as a text file.
- To check a download, paste its published checksum, or a whole line from a checksum file, into the compare box.
Which hash to use
- SHA-256 is the common choice today for checksums and most security uses. SHA-384 and SHA-512 are longer members of the same family.
- MD5 and SHA-1 are broken for security: people have made different files with the same hash. They’re fine only for spotting accidental damage, such as checking a download against a published checksum. Never rely on them for passwords or signatures.
- To check a download, use the one the publisher lists. A checksum only helps when you compare the same kind of hash; the compare box works out which kind it is from its length.
How it works
SHA-1 and the SHA-2 hashes come from your browser’s own Web Crypto. Browsers don’t offer MD5, so this page has its own implementation, tested against the examples in its specification, RFC 1321. Text is hashed as UTF-8 exactly as typed. A file is read into memory and hashed in the page, so a very large one takes a moment and needs enough memory to hold it; the page shows its progress while it works.
Good to know
- A match is only as good as the checksum: take it from a source you trust, such as the publisher’s own https page, not from the same place as a doubtful file.
- Not for storing passwords: those need a slow, salted method such as bcrypt or Argon2, not a fast hash.
- No keyed hashes: this tool doesn’t do HMAC; it hashes the data alone.
- Two PDFs with different hashes can still look alike. Compare PDFs shows what changed.
- Everything happens on your device: nothing is uploaded, sent or saved.