Hash Generator — SHA-256, SHA-512, SHA-1 & MD5

Hash text or files and verify checksums — computed instantly on your device with the browser's crypto engine. Nothing is uploaded.

SHA-256

SHA-512

SHA-1 legacy

MD5 legacy

Hashing text and verifying file checksums

A cryptographic hash is a fixed-length fingerprint of data: change one byte and the digest changes completely. This tool computes SHA-256, SHA-512 and SHA-1 with the browser's native Web Crypto API (hardware-accelerated) and MD5 with a compact local implementation — for text, live on every keystroke; for files, via drag & drop up to 200 MB. Your data never leaves the device.

The most common use: verifying downloads. Publishers list a checksum (usually SHA-256) beside each file; hash your downloaded copy here and paste the published value into the verify box — matching is done algorithm-aware and case-insensitively. A mismatch means corruption or tampering: delete the file. For authenticity use SHA-256/512 only; SHA-1 and MD5 are collision-broken and included solely for matching legacy checksums.

One caution: plain hashes are the wrong tool for storing passwords — brute force is too fast. Password systems need slow, salted algorithms (bcrypt, scrypt, Argon2). Need a strong password instead? Use the Password Generator; encoding data rather than hashing? See Base64 Encoder/Decoder.

Frequently Asked Questions

Which algorithm should I use?
SHA-256 as the default; SHA-512 for a larger digest. SHA-1/MD5 only to match legacy published checksums — never for security decisions.
How do I verify a download?
Drop the file, then paste the publisher's checksum into the verify box. Match = intact; mismatch = corrupted or tampered, don't run it.
Is my file uploaded?
No — files are read with FileReader and hashed by your browser's own crypto engine. Zero network traffic.
Why does MD5 still exist?
Legacy systems still publish MD5 sums. It detects accidental corruption fine, but collisions can be forged — never trust it for authenticity.
Can a hash be reversed?
No, hashing is one-way. But short/common inputs can be brute-forced — that's why passwords need slow, salted hashing (bcrypt/Argon2), not SHA-256.