How to use the hash generator

  1. Choose Text and type or paste text, or choose File to hash a file from your computer.
  2. MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes are calculated at the same time.
  3. To check a download, paste the checksum published by the software vendor into Compare with an expected hash. The tool tells you which algorithm matches, or warns you that nothing matches.
  4. Tick Uppercase hex if the system you compare against shows hashes in capitals. The value is the same either way.

Text is converted to UTF-8 bytes before hashing, so results match command-line tools such as sha256sum and md5sum for the same text without a trailing newline. Files are read in your browser and are never uploaded.

What a hash function does

A cryptographic hash function turns input of any size into a fixed-length fingerprint:

  • The same input always gives the same hash.
  • A tiny change in the input, even one character, gives a completely different hash.
  • You cannot work backwards from a hash to the original input.

For example, the SHA-256 hash of abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, but the hash of abd shares almost nothing with it.

Which algorithm to use

  • SHA-256: the default choice today for checksums, digital signatures, and data integrity. Git, Bitcoin, and TLS certificates use it.
  • SHA-384 and SHA-512: longer outputs from the same SHA-2 family. SHA-512 can be faster than SHA-256 on 64-bit processors.
  • SHA-1: broken for security since a practical collision was published in 2017. Still found in older systems.
  • MD5: collisions can be created in seconds. Use it only to detect accidental corruption, such as a file damaged during download, never to protect against tampering.

Hashes are not for storing passwords

Plain hashes, even SHA-512, are designed to be fast. That makes them a poor choice for storing passwords, because attackers can try billions of guesses per second. Store passwords with a dedicated password hashing function that is slow by design and uses a unique salt for each password: Argon2id, scrypt, or bcrypt.

Verifying a download

  1. Find the checksum on the official download page, for example a line labeled SHA-256.
  2. Choose File, select the downloaded file, and paste the checksum into the compare box.
  3. If it matches, the file is identical to the one the publisher hashed. If it does not, download the file again from the official source.

A matching checksum only proves the file was not changed after the checksum was published. If an attacker controls the download page, they can change both, which is why some projects also sign their checksums with GPG.

Frequently asked questions

Why doesn't my result match another tool?

Usually because the input is different. Many command-line examples hash a trailing newline (echo "abc" | sha256sum hashes abc\n). Spaces at the end, Windows line endings, and different text encodings also change the result.

Is there a size limit for files?

There is no fixed limit, but very large files (several gigabytes) may use a lot of memory, because the browser reads the whole file before hashing.