Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes from text.
By Syed Mubashir Ali · Last updated
Which hash should you use?
For checking that a file or download hasn't changed, use SHA-256: it's the standard checksum on most download pages and in tools like sha256sum. MD5 and SHA-1 are here because older sites and systems still print them, but both are broken for security, since collisions can be made deliberately, so use them only to compare against a checksum someone has already given you. SHA-384 and SHA-512 are longer members of the same SHA-2 family.
None of these should be used on their own to store passwords: they're designed to be fast, which makes guessing easy. Password storage needs a slow, salted algorithm such as bcrypt, scrypt or Argon2. A hash also depends on the exact bytes. 'hello' and 'hello' followed by a line break give completely different results, which is the usual reason a hash here doesn't match one from the command line: echo adds a line break, while printf or echo -n doesn't.
- Bcrypt Generator: make and check bcrypt hashes, the slow, salted kind built for storing passwords.
How hash verification catches problems
Corrupted downloads
A download interrupted and resumed, a flaky connection, or a truncated file will produce a completely different hash from the published one. The mismatch tells you immediately that the file can't be trusted, before you install or deploy it.
Tampered files
If someone modifies a file (inserting malware into an installer, for example) the hash changes. Comparing against the vendor's published checksum is a simple but effective integrity check, which is why Linux distributions publish SHA-256 sums for every ISO.
How to Use Hash Generator
- 1Type or paste your text, or switch to File and choose a file to check a download's checksum.
- 2All five hashes (MD5, SHA-1, SHA-256, SHA-384 and SHA-512) appear at once and update as you type.
- 3To check a download, paste the checksum from its web page into 'Compare with a checksum': the matching algorithm lights up green, or you're told nothing matches.
- 4Add a secret key to get HMACs instead (used to sign API requests and webhooks), and choose hex, upper-case HEX or Base64 output.
- 5Copy any individual hash using its copy button.
Frequently Asked Questions
Is the MD5 hash safe to use?
Not for security. MD5 is cryptographically broken (collisions can be produced on a laptop) so never use it to store a password or verify a signature. It is included because some download pages and older documentation still publish MD5 checksums, and checking against one of those is a perfectly good use of it. For anything security-related use SHA-256 or SHA-512, which the browser computes natively.
Are these hashes the same as command-line sha256sum?
Yes. The SHA algorithms produce identical output to OpenSSL, sha256sum, and any other standard implementation for the same input.
Can I hash a file?
Yes. Switch to File and choose it (up to 200 MB); it's hashed on your device and never uploaded. Paste the checksum from the download page into 'Compare with a checksum' to confirm the file arrived intact. Text is hashed as UTF-8 bytes, the standard approach.
What is an HMAC?
A hash that also depends on a secret key, so only someone with the key can produce it. Services such as Stripe, GitHub and Shopify sign webhooks with HMAC-SHA256: you hash the request body with your secret and compare. Enter the key in 'HMAC secret key' to get HMAC-MD5 to HMAC-SHA512, checked against the RFC 2104 and RFC 4231 test vectors.
Why doesn't my hash match the one from the command line?
Almost always a hidden character. echo "text" | sha256sum hashes the text plus a line break; use echo -n or printf to hash the text alone. Trailing spaces and Windows line endings change the hash too. Text here is hashed as UTF-8, the same as most tools.
Can a hash be reversed?
No. A hash is one-way: you can't work back from it to the input. But short or common inputs, such as simple passwords, can be found by looking their hashes up in huge pre-computed tables, which is another reason not to use plain hashes for passwords.
What's the difference between SHA-256, SHA-384 and SHA-512?
They're all members of the SHA-2 family, differing mainly in output length: 256, 384 and 512 bits. Longer hashes are stronger against collision attacks but take slightly more time to compute. SHA-256 is the most widely used: the usual choice for download checksums, TLS certificates and many other protocols. SHA-512 can actually be faster on 64-bit processors despite the longer output.
Why is MD5 still included if it's broken?
Because the real world still uses it. Thousands of download pages, legacy systems, and older documentation publish MD5 checksums. This tool hashes text you type or paste, locally in your browser, which is handy for checking a short string against an MD5 or SHA value given in old documentation.
Does hashing the same text twice give the same result?
Yes, always. Cryptographic hashes are deterministic: identical input bytes always produce identical output. That's what makes them useful for integrity checks: if even one byte changes, the hash changes completely.
Does it remember what I typed?
Not unless you ask. "Remember recent inputs" is off for this tool because people often hash passwords. Tick it to keep the last five inputs in this browser only (nothing is sent anywhere), with a Recent menu to bring one back and "Clear recent" to forget them.
About Hash Generator
Cryptographic hashes are one-way functions that produce a fixed-length fingerprint of any input. They're used to verify file integrity, store passwords securely, and create digital signatures.
Our Hash Generator uses the browser's built-in Web Crypto API (crypto.subtle) to compute SHA-1, SHA-256, SHA-384, and SHA-512 hashes, and its own MD5 code, since MD5 isn't part of Web Crypto. Because everything runs locally, sensitive data never leaves your device.
The most common day-to-day use is verifying downloads. When a software vendor publishes a SHA-256 checksum next to a download link, they're giving you a way to confirm the file arrived intact and untampered. This page hashes text rather than files, so for a download use the command built into your computer: sha256sum file on Linux, shasum -a 256 file on macOS, or certutil -hashfile file SHA256 on Windows. If the hashes match, you have exactly what the vendor published.
Developers also use hashes constantly: Git identifies every commit by a SHA-1 hash (SHA-256 repositories are an option), APIs use HMAC signatures built on SHA-256, and content-addressed storage systems like IPFS locate files by their hash. Understanding what a hash is (and what it isn't) is foundational to modern software security.