Hash Generator: SHA-256, SHA-512, SHA-1, MD5
Type some text or choose a file: the hash generator instantly calculates the SHA-256, SHA-384, SHA-512 and SHA-1 checksums, and MD5 on request. Paste an expected hash (for example from a download page) to compare it directly. Everything runs in your browser – files are never uploaded.
How it is calculated
A hash function maps data of any length to a value of fixed length – the hash, digest or checksum. The same input always gives the same hash; changing a single character produces a completely different one. You can’t work back from the hash to the input.
The algorithms
- SHA-256 (256 bits, 64 hex characters): today’s standard – for download checksums, Git, certificates and blockchains. Specified, like SHA-384 and SHA-512, in NIST FIPS 180-4.
- SHA-384 and SHA-512 (96 and 128 hex characters): longer members of the SHA-2 family; on 64-bit machines SHA-512 is often even faster than SHA-256.
- SHA-1 (40 hex characters): considered broken since the first practical collision attack in 2017. NIST has disallowed it for digital signatures; it still shows up as a plain checksum, for example in older Git versions.
- MD5 (32 hex characters): broken since 2004 (RFC 6151). Two different files with the same MD5 can be created in seconds. Only useful as a checksum against accidental transmission errors. Because browsers don’t include MD5, the tool uses its own implementation, verified against the test values in RFC 1321.
Verifying a download
Many projects publish a SHA-256 checksum next to the file. Select the file here and paste the published value into “Compare with expected hash” – if it matches, the file arrived unchanged. Case, spaces and colons in the expected value don’t matter. On Windows you can do the same with certutil -hashfile file SHA256, on macOS and Linux with shasum -a 256 file or sha256sum file.
Why does my hash differ?
Usually because of invisible characters: echo text | sha256sum hashes the text with a line break, echo -n without. Windows line endings (CR LF instead of LF), a byte order mark or an encoding other than UTF-8 also change the hash.
Hashes and passwords
Fast hashes such as SHA-256 or MD5 are unsuitable for storing passwords – attackers can try billions of guesses per second. Use slow, salted algorithms such as Argon2, scrypt or bcrypt instead.
Hashes are calculated with your browser’s Web Crypto API. Your text, file and comparison value are not sent, not stored and not written into the address bar.
Frequently asked questions
How do I get the SHA-256 hash of a file?
Choose the file under “Or hash a file” – the SHA-256 value appears straight away at the top of the result. The file is only read inside your browser and is never uploaded.
Can a hash be decrypted?
No. A hash isn’t encryption but a one-way function. For short or common inputs (such as weak passwords), however, attackers can find a matching input by trial and error or with precomputed tables.
Is MD5 still secure?
No. MD5 has been broken since 2004; collisions can be generated on an ordinary computer in seconds. For security, use SHA-256 or stronger. As a checksum against accidental transmission errors, MD5 still does the job.
Why doesn’t my hash match the one from the command line?
The most common cause is a line break: echo "text" | sha256sum appends a \n. Use echo -n or printf. Different line endings (Windows CR LF) or character encodings also change the hash.
What is the difference between hex and Base64 output?
It is the same hash written differently: hexadecimal uses 2 characters per byte (SHA-256 = 64 characters), Base64 is shorter (44 characters). Base64 is used, for example, in Subresource Integrity (integrity="sha256-…").
Sources and legal basis
- FIPS 180-4: NIST FIPS 180-4 – Secure Hash Standard (SHS)
- NIST – Example values for SHA-1, SHA-256, SHA-384, SHA-512 (test vectors)
- RFC 1321: RFC 1321 – The MD5 Message-Digest Algorithm (Appendix A.5 test suite)
- RFC 6151: RFC 6151 – Updated Security Considerations for MD5 and HMAC-MD5
- NIST – Transitioning away from SHA-1 (SP 800-131A Rev. 2)
- MDN Web Docs – SubtleCrypto.digest()
As of:
Related tools
- Base64 Encode and DecodeEncode and decode Base64 and Base64url with proper UTF-8, plus URL encode/decode (percent-encoding). Clear error messages, runs locally in your browser.
- Password GeneratorGenerate secure random passwords and memorable passphrases with entropy shown in bits — calculated right in your browser, nothing sent or stored.
- UUID generator: create and validate UUID v4 and v7Generate UUIDs online: version 4 (random) or version 7 (time-ordered), up to 1,000 at once. Validate a UUID and decode its version, variant and timestamp.
- Regex TesterTest JavaScript regular expressions live: matches highlighted, capture groups in a table, every part of the pattern explained. Free, nothing uploaded.
- Luhn Check Digit Validator and CalculatorValidate numbers with the Luhn algorithm (mod 10, ISO/IEC 7812-1) or calculate the check digit – format check only, runs locally in your browser.
- Aspect Ratio CalculatorCalculate the aspect ratio from width and height (1920 × 1080 = 16:9), find the missing side, decimal value, nearest standard ratio and CSS aspect-ratio.