Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 checksums from text or a file — all four at once.
No data sent to serverRelated Tools
What a Hash Is For
A hash function turns any input — three characters or a three-gigabyte file — into a fixed-length fingerprint. Change a single bit of the input and the output changes completely. That property makes hashes useful for one thing above all: proving two things are identical without comparing them directly.
That is why download pages publish checksums. You fetch a file from a mirror, hash it locally, and compare against the number the original publisher posted. If they match, the file arrived intact and unmodified. If they differ, something went wrong — a corrupted transfer, or a tampered mirror.
Which Algorithm to Use
- MD5 — 128 bits, fast, and cryptographically broken. Researchers can construct two different files with the same MD5 hash on a laptop. Still perfectly fine for detecting accidental corruption, which is why so many download pages still publish it. Never use it for passwords or signatures.
- SHA-1 — 160 bits, also broken. A practical collision was demonstrated in 2017. Present here because older systems still emit it, not because you should choose it.
- SHA-256 — 256 bits, the current default for essentially everything. Fast, well analysed, no known practical weaknesses. If you are unsure, use this.
- SHA-512 — 512 bits, from the same family. Often faster than SHA-256 on 64-bit hardware. Use when a longer digest is required.
Hashing Is Not Encryption
This confusion causes real damage, so it is worth being blunt. Encryption is reversible — with the key, you get the original back. Hashing is one-way by design; there is no key and no way back. A hash of “hello” is not a hidden version of “hello”, it is a fingerprint of it.
A related trap: hashing is not sufficient for storing passwords. Because hashes are fast to compute, an attacker with a stolen database can try billions of guesses per second. Password storage needs a deliberately slowfunction with a per-user salt — bcrypt, scrypt, or Argon2. Plain SHA-256 is the wrong tool, no matter how modern it sounds.
Technical notes
- SHA family: computed with the browser’s built-in Web Crypto API
- MD5: implemented in JavaScript, because Web Crypto deliberately excludes it as an unsafe algorithm
- Text encoding: UTF-8, which is what other tools assume — the same string will produce the same hash elsewhere
- Files: read fully into memory and hashed byte-for-byte, matching what
md5sumorsha256sumwould report - Output: lowercase hexadecimal, the conventional format
Verifying a Download the Way It Is Meant to Be Done
The point of a published checksum is to detect a file that arrived wrong — truncated by a dropped connection, corrupted by a failing disk, or served by a mirror that has been tampered with.
The procedure is: download the file, hash it locally, and compare against the value published by the original project. Two details matter. First, get the checksum from the project’s own site, not from the same mirror that served the file — an attacker who controls the download can equally control a checksum published alongside it. Second, match the algorithm; pages often publish SHA-256 while people paste an MD5 and conclude the file is broken.
For genuinely security-critical software, a signed checksum file verified with the project’s public key is stronger than a bare hash, because it proves who published the value.
FAQ
Can I reverse a hash to get the original text?
No. Hashing discards information by design, so nothing can undo it. What lookup sites do is hash enormous dictionaries in advance and check whether your value appears — which works for common words and fails for anything unpredictable.
Why do I get a hash for empty input?
Because zero bytes is still valid input. The MD5 of an empty string is d41d8cd98f00b204e9800998ecf8427e, a value that turns up often enough to be worth recognising.
Should I still use MD5?
For checking that a download was not corrupted, yes — it is fast and that is a non-adversarial problem. For anything where someone might deliberately craft a colliding file, no. Use SHA-256.
Does my file get uploaded to check its hash?
No. It is read and hashed inside your browser, which matters when the file is confidential and you only need its fingerprint.
My hash does not match the one on the download page.
Check you are comparing the same algorithm — pages often list SHA-256 while people paste an MD5. Then re-download; the usual cause is a truncated or corrupted transfer.
Can I hash a very large file?
The file has to fit in browser memory, so multi-gigabyte images are better handled by sha256sum on the command line.
Where should I get the checksum to compare against?
From the project’s own site rather than the mirror that served the download. A checksum published next to a compromised file offers no protection, since whoever replaced the file could replace the checksum too.
Is a checksum the same as a signature?
No. A checksum proves the bytes are unchanged; a signature additionally proves who published them. Security-critical downloads should be verified against a signed checksum file.
⚠️ Reference Only
Output is generated based on your input and is provided for reference. Results may vary depending on your specific use case, edge cases, or environment-specific behavior. We do not guarantee accuracy of conversions, validations, or computed values.
Always verify critical outputs against official documentation or production environments. We are not responsible for any decisions or losses based on these tool results.