Hash Generator

Verifying a download without uploading it

The most common reason to hash a file is to check that what you downloaded is what the publisher released. They publish a checksum; you generate one from your copy; the two should match exactly. If they do not, the file is corrupt or has been tampered with.

Doing that through a site that uploads the file is both slow and slightly absurd — you would be sending a 4GB installer somewhere to confirm it arrived intact. Here the file is read from disk in the page, so the size is limited only by your device, and nothing leaves it.

Published checksums appear in both uppercase and lowercase, which is why there is a case toggle. The value is the same either way; only the presentation differs, and matching the format makes comparing by eye far easier.

MD5 and SHA-1 are broken — and still useful

This confuses a lot of people, so it is worth stating precisely.

Both MD5 and SHA-1 are cryptographically broken: it is practical to construct two different inputs that produce the same hash. That makes them unsuitable for anything where someone might deliberately deceive you — digital signatures, certificates, verifying a file from an untrusted source.

They are still perfectly fine for detecting accidental change. If you are checking whether a download got corrupted, whether two files are identical, or whether a file changed since last week, MD5 tells you that instantly and correctly. Nobody is constructing a collision against your holiday photos. Plenty of software still publishes MD5 checksums for exactly this reason.

The rule: use SHA-256 when the threat is a person, MD5 or SHA-1 when the threat is a corrupted transfer. SHA-256 is the sensible default when you do not want to think about it.

Never hash a password with these

This matters more than anything else on the page. None of these algorithms should be used to store passwords — not MD5, not SHA-256, not SHA-512.

They are designed to be fast, and speed is exactly the wrong property for password storage: it lets an attacker with a stolen database try billions of guesses per second. Password storage needs a deliberately slow algorithm built for the job — bcrypt, scrypt or Argon2 — with a unique random salt per password. This is the single most common serious mistake made with hash functions, and it is behind a lot of breach headlines.

Use this tool for checksums, file comparison and data fingerprinting. Not for credentials.

Hashing text

The text tab hashes exactly what you type, and hashes are unforgiving — a trailing space or a newline produces a completely different result. If two hashes of what looks like the same string do not match, check for invisible whitespace first, because that is almost always the answer.

Related tools

Base64 Encoder encodes data so it survives text-only systems, which is a different job from hashing — Base64 can be reversed, a hash cannot. Password Generator creates strong passwords, which belong in a password manager rather than in a hash.