Hash Generator
Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hash of text or a file at once, and check a download against its published checksum.
Files are hashed in your browser and never uploaded.
Text is hashed as UTF-8, exactly as typed: a trailing space or line break changes the hash.
The hashes appear here as you type.
Related Developer Tools
This hash generator calculates the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text or file at once. Use it to check that a download matches the checksum its publisher lists, to compare two files without opening them, or to get a hash for code, a cache key or a test. The SHA hashes use your browser's built-in Web Crypto, and everything stays on your device.
Hashes of "hello"
The five algorithms give outputs of different lengths. These are the hashes of the five letters hello, with no line break:
| Algorithm | Bits / hex characters | Hash |
|---|---|---|
| MD5 | 128 / 32 | 5d41402abc4b2a76b9719d911017c592 |
| SHA-1 | 160 / 40 | aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d |
| SHA-256 | 256 / 64 | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
| SHA-384 | 384 / 96 | 96 hex characters |
| SHA-512 | 512 / 128 | 128 hex characters |
Change one letter, to Hello, and every hash changes completely. That is what makes a hash useful as a fingerprint: you cannot tell from two hashes how similar the inputs were, only whether they are identical.
Which Algorithm to Use
- SHA-256: the standard choice for checksums, signatures, Git's newer object format, Bitcoin and certificate fingerprints. Use it unless something else is required.
- SHA-512 / SHA-384: longer outputs from the same SHA-2 family. On 64-bit processors without built-in SHA-256 instructions, SHA-512 can be faster than SHA-256 on large files.
- SHA-1: still used for Git commit IDs and older checksums. Broken for security purposes.
- MD5: common for old download checksums, ETags and deduplication. Broken for security purposes; fine for detecting accidental damage.
Checking a Download
Software sites often publish a SHA-256 checksum next to each download, sometimes in a file called SHA256SUMS or .sha256. After downloading, hash the file here and paste the published value into the compare box. The tool recognises the algorithm from the length of what you paste and highlights the matching row. A match proves the file was not damaged in transit. It proves the file is genuine only if you got the checksum from a source you trust, such as the official site over HTTPS, since anyone who can replace a file can also replace a checksum stored next to it.
Related Tools
To check a token's HMAC-SHA256 signature, use the JWT decoder. To turn binary data or a file into text, use the Base64 encoder, and for unique IDs rather than fingerprints, the UUID generator.
Frequently Asked Questions
How do I get the SHA-256 hash of a file?
Press Hash a file and choose it. All five hashes are calculated in your browser, so even private files never leave your device. Files up to 512 MB can be hashed this way.
How do I verify a download with a checksum?
Hash the downloaded file, then paste the checksum published on the download page into Compare with a checksum. A green Match means the file is exactly what the publisher released; any other result means the file is corrupted or not the same file. The comparison ignores case, and you can paste a whole line from a SHA256SUMS file.
Can a hash be reversed to get the text back?
No. A hash is one-way: there is no calculation that turns it back into the input. Short or common inputs can still be found by guessing, which is how lookup sites "decrypt" MD5 hashes of simple words. That is also why a plain hash is not safe for storing passwords.
Is MD5 or SHA-1 still safe to use?
Not where someone might attack it. Different inputs with the same MD5 hash have been made since 2004, and for SHA-1 since 2017, so neither should be used for signatures, certificates or anything security-related. Both are still fine for spotting accidental corruption or as cache keys. Use SHA-256 or stronger for new work.
Should I hash passwords with SHA-256?
No. SHA-256 is designed to be fast, which lets an attacker test billions of guesses per second. Passwords need a deliberately slow, salted algorithm such as Argon2id, bcrypt or scrypt, which your language's password library provides.
Why is my hash different from another tool's?
The input almost always differs: a trailing line break (echo adds one unless you use echo -n), a space, Windows versus Unix line endings, or a different text encoding. This tool hashes text exactly as typed, as UTF-8.
How do I compute a hash on my own computer?
Windows: certutil -hashfile file.zip SHA256, or Get-FileHash file.zip in PowerShell. macOS: shasum -a 256 file.zip. Linux: sha256sum file.zip. Replace 256 or SHA256 with another algorithm name as needed.