Hash Generator
MD5, SHA-1, SHA-256, SHA-512 and CRC32 of text or files, with checksum compare
Runs entirely in your browser. Nothing you type or upload is sent to us or stored.
Results are for general guidance. Please check anything important before relying on it. Terms of use
How to Use
- Choose Text to hash something you type or paste, or File to hash a file from your device.
- Type the text (hashes update as you type) or drop a file. Large files show a progress percentage while they're read.
- Read the MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 values. Switch between Hex and Base64 output if needed.
- To verify a download, paste the checksum from the publisher's website into Compare with expected hash.
- A green Match means the file is intact; No match means it differs. Use the copy icon to copy one hash, or Copy all hashes to copy the whole list.
What is a hash?
A hash function turns any input, a single word or a 4 GB video, into a short fixed-length "fingerprint". The same input always gives the same hash, and changing even one character gives a completely different one. You can't get the original data back from a hash. That's why hashes are used to check that a download isn't corrupted or tampered with, to spot duplicate files, and to store fingerprints of data in software. This hash generator works out MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 for text or files.
MD5("abc") = 900150983cd24fb0d6963f7d28e17f72
CRC32("abc") = 352441c2
Type abc into the tool and you'll get exactly these values. Type Abc and every one of them changes.
Which algorithm should I use?
| Algorithm | Output | Status | Typical use |
|---|---|---|---|
| MD5 | 128 bits (32 hex) | Broken for security | Old download checksums, duplicate detection |
| SHA-1 | 160 bits (40 hex) | Deprecated | Legacy systems, older Git repositories |
| SHA-256 | 256 bits (64 hex) | Secure | Software downloads, certificates, blockchains |
| SHA-384 | 384 bits (96 hex) | Secure | TLS, subresource integrity (SRI) |
| SHA-512 | 512 bits (128 hex) | Secure | Checksums from some Linux distributions, high-security uses |
| CRC32 | 32 bits (8 hex) | Not cryptographic | ZIP and PNG files, detecting accidental errors |
Researchers showed practical MD5 collisions (two different inputs with the same hash) in 2004, and the first public SHA-1 collision ("SHAttered") was announced in 2017. So never rely on MD5 or SHA-1 where someone might deliberately forge data. They're still fine for catching accidental corruption. For anything security-related, use SHA-256 or stronger.
How to verify a downloaded file
- On the official download page, find the checksum next to the file. It is often labelled "SHA256" or in a file like
SHA256SUMS. - Switch this tool to File and choose the downloaded file.
- Paste the published checksum into Compare with expected hash. The tool finds the matching algorithm on its own and ignores spaces, colons and upper/lower case.
A match proves your copy is byte-for-byte identical to what the publisher hashed. A mismatch usually means an incomplete download. Download again, and if it still fails, don't run the file. And a checksum is only as trustworthy as the page you copied it from.
Good to know
- Text is hashed as UTF-8. Hindi, Gujarati or emoji characters take 3 to 4 bytes each, and the byte count above the box shows exactly what is hashed.
- Invisible characters matter. A trailing space or newline changes the hash. Text copied from Windows files may use CRLF line endings, while a browser text box uses LF, so a file and the same text pasted here can hash differently. Use File mode to hash a file exactly.
- Hashes are not encryption, and plain SHA-256 is not suitable for storing passwords. Websites should use a slow password hash such as bcrypt, scrypt or Argon2.
- Privacy: files are read and hashed inside your browser (SHA via the built-in Web Crypto API). Nothing is uploaded, so it's fine for large or confidential files.