Hash Generator

The Hash Generator computes several hashes of the same input in one pass, so you don't have to know in advance which algorithm a download page or an API used.

1. Under Input, choose Text to hash what you type or paste into Text to hash, or File to drop a file from your device.
2. Under Algorithms, pick what to compute. MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are on by default, and CRC32 can be switched on when you need it.
3. Set the Output format to Hex or Base64. For hex output, Letter case chooses between Lowercase and Uppercase.
4. Optionally paste a published checksum into Expected checksum.
5. Press Generate hashes.

The Hashes table shows one row per algorithm with its digest, ready to copy. When you filled in an expected checksum, a Check column marks each row Match or No match, and a headline above the table names the algorithm that matched, for example "The expected checksum matches SHA-256".

A footnote under the table confirms what was hashed: the file name and size, or the size of your text in UTF-8 bytes. That is a quick way to spot a truncated file or an invisible extra character. The results can be exported as CSV, Excel, PDF or an image.

For work that is only about MD5, our dedicated MD5 tools go further: the text to MD5 generator has line ending and trim options plus HMAC-MD5, and the bulk text MD5 tool hashes a whole list of strings at once.

Software publishers often list a checksum next to an ISO image, an installer, firmware or a .wasm build. Comparing it with the hash of the file you received tells you whether the download arrived intact.

1. Copy the checksum from the publisher's page. It is usually labeled SHA-256, sometimes SHA-512, SHA-1 or MD5.
2. Choose File and drop the downloaded file. A progress bar shows the file being read.
3. Paste the checksum into Expected checksum. A whole line copied from sha256sum output or a .sha256 file also works, because only the first token is used.
4. Press Generate hashes and look for the Match row.

If one row says Match, your file is identical, byte for byte, to the file the checksum was made from. If every row says No match, the file differs or the checksum belongs to another file or version.

A single changed byte produces a completely different hash. This is called the avalanche effect: the SHA-256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, while Hello with a capital H gives 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969. No partial similarity survives, so you can trust a match and you cannot "almost" match.

Know what a match proves. A checksum published on the same server as the file only shows that the download was not damaged on the way. If an attacker controls that server, they can replace both. A checksum file signed with the publisher's PGP key, or one listed on a separate trusted site, goes further. A match never proves a file is free of malware, only that it is the same file the publisher hashed.

On the command line the equivalents are sha256sum on Linux, certutil -hashfile on Windows and shasum -a 256 on macOS.

All six algorithms turn any input into a fixed length digest, but they differ in length and in how well they resist deliberate attacks.

A collision means two different inputs with the same digest. For MD5 and SHA-1, researchers can produce such pairs on purpose, which breaks any use where an attacker chooses the input: digital signatures, certificates, or proving that a file has not been swapped.

The practical rule:

• Accidental corruption (a broken download, a bad copy, a flaky disk): any algorithm works, including MD5 and CRC32. Use whatever the publisher listed.
• Anything an attacker could tamper with: use SHA-256 or stronger. SHA-256 is the safe default and by far the most widely published checksum today.
• New systems: pick SHA-256 or SHA-512, never MD5 or SHA-1.

CRC32 is the checksum inside zip, gzip and PNG files. It is fast and catches transmission errors well, but anyone can craft data with a chosen CRC32 value, so it is off by default here.

When a download page lists only MD5, that is fine for spotting damage. For MD5 of a single file with an HMAC key, the file MD5 tool is the better fit.

Encryption is two-way: data is locked with a key and can be unlocked with the right key. A hash is one-way. It has no key, its output has a fixed length no matter how large the input is, and there is nothing to decrypt. A 1 GB ISO image and a single word both give a SHA-256 digest of 64 hex characters.

That does not make every hash secret. Short or common inputs can be found by guessing: an attacker hashes millions of likely words and passwords and compares the results, or looks the digest up in a precomputed table. The MD5 of hello is 5d41402abc4b2a76b9719d911017c592, and searching for that string online reveals the input in seconds. Nothing was reversed; the answer was simply guessed or already listed.

This is why passwords must not be stored as plain SHA-256 or MD5 hashes. Both algorithms are built to be fast, and fast is exactly what a password guesser wants. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2. The salt is a random value stored with each hash, so two users with the same password get different hashes and precomputed tables become useless.

General purpose hashes like the ones on this page are right for:

• file and download checksums
• detecting duplicate files or changed content
• cache keys and ETags
• checking test vectors when you implement or debug an algorithm

A hash depends on the exact bytes of the input. Two texts that look the same on screen can produce completely different digests.

The usual causes:

• A trailing newline. Many command line examples hash text with a line break at the end. echo hello | sha256sum hashes hello plus a newline and gives 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03, while this tool hashes exactly hello and gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
• Spaces. A leading or trailing space copied by accident changes everything.
• Line endings. Windows uses a carriage return plus line feed, Unix and macOS only a line feed. Multi-line text pasted from different sources can differ here.
• Text encoding. This tool always encodes text as UTF-8. Another tool using UTF-16 or Latin-1 gives a different result for any character outside basic ASCII, such as é or ü.
• Wrong algorithm. Comparing an SHA-256 checksum with an SHA-512 result never matches. With every algorithm enabled, the Check column shows which one fits.
• Incomplete file. An interrupted download hashes differently. Compare the size in the footnote with the size the publisher lists.

The Hash Generator never trims or normalizes your text, so what you type is what gets hashed. The Input size footnote shows the byte count, which reveals an invisible extra character.

Letter case in hex output does not matter: ABC123 and abc123 are the same value, and the Expected checksum comparison ignores case for hex. Base64 is different, because upper and lower case letters are distinct digits there, so a Base64 checksum has to match exactly.

If you need MD5 with a choice of line endings or trimming, the text to MD5 generator has those options.

Your file is never uploaded. The Hash Generator reads it from your disk into the browser tab and hashes it there, using the browser's built-in Web Crypto API for the SHA algorithms. No copy reaches a server, which matters when the file is a contract, a database dump or an unreleased build. Once the page has loaded, hashing works even without an internet connection.

Files can be up to 1 GB. The limit exists because Web Crypto has no streaming mode: the whole file has to sit in memory as one block before it can be hashed. That covers typical installers and most ISO images on a desktop computer. On phones and tablets with less memory, very large files may still fail, and the tool then suggests trying a smaller one. For bigger files, the command line tools sha256sum, certutil and shasum read in chunks and have no such ceiling.

The tool is free, needs no account and has no daily limit or size-based paywall. You can hash as many files and texts as you like.

To hash many files at once, the bulk file MD5 tool computes MD5 checksums for a whole batch, useful when comparing a folder before and after a copy.