Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hashes from text or files instantly. All processing happens locally in your browser.
How to Use
Choose Text or File Mode
Click the "Text" tab to hash a string of text, or click the "File" tab to hash any file on your device. File hashing is useful for verifying the integrity of downloads and backups.
Enter Your Input
In text mode, type or paste any text into the input area. In file mode, click the upload area and select any file — the file is read locally and never uploaded to a server.
Generate All Hashes
Click "Generate Hashes" (in text mode) or simply select a file. All four hashes — MD5, SHA-1, SHA-256, and SHA-512 — are computed and displayed simultaneously.
Copy Individual Hashes
Click the "Copy" button next to any algorithm to copy that specific hash value to your clipboard. Compare the hash with the one provided by a trusted source to verify file integrity.
Hash Generator — Generate MD5, SHA-1, SHA-256, and SHA-512 Hashes
A cryptographic hash function takes any input — text, a file, a password — and produces a fixed-length string of characters called a hash or digest. The same input always produces the same hash, but even a tiny change in the input produces a completely different hash. This property makes hashes useful for verifying data integrity, checking if files have been tampered with, and storing passwords securely.
Supported algorithms
MD5: Produces a 128-bit (32 hex character) hash. Fast and widely recognised, but cryptographically broken for security purposes — do not use MD5 for password hashing or integrity-critical applications. Still commonly used for checksums and non-security use cases like deduplication.
SHA-1: Produces a 160-bit (40 hex character) hash. Also considered cryptographically weak for collision resistance. Still used in some legacy systems (Git uses SHA-1 internally for commit hashes) but not recommended for new security applications.
SHA-256: Part of the SHA-2 family. Produces a 256-bit (64 hex character) hash. Currently considered secure for most applications and is the standard for file integrity checking, digital signatures, TLS certificates, and cryptocurrency (Bitcoin uses SHA-256). If you need a hash for security purposes, SHA-256 is the right choice.
SHA-512: A larger variant of SHA-2, producing a 512-bit (128 hex character) hash. More resistant to brute-force attacks because of its larger output size. Preferred for password hashing contexts when combined with proper salting, though dedicated password hashing algorithms (bcrypt, Argon2) are better suited for that specific use case.
Common use cases
Verifying file downloads: When you download software, many sources publish the SHA-256 hash of the file alongside the download link. After downloading, generate the hash of your downloaded file and compare it to the published value. If they match, the file is identical to what the publisher distributed and hasn't been corrupted or tampered with in transit.
Checking data integrity: If you're transferring a large file between systems, hash it before and after. Matching hashes confirm the file arrived intact.
Deduplication: Two files with the same MD5 or SHA hash are almost certainly identical files (barring the vanishingly rare collision). Use hashes to identify duplicate files in a large collection without comparing every byte.
Password storage (with caveats): Properly stored passwords are never saved as plain text — instead, their hash is saved. When a user logs in, the hash of the entered password is compared against the stored hash. However, direct SHA hashing of passwords is insufficient on its own; you need salted hashing with algorithms specifically designed for passwords (bcrypt, Argon2). This tool is for learning and verification, not for building login systems.
API request signing: Some APIs require you to sign requests with an HMAC-SHA256 hash of the request content. While this tool generates standard SHA-256 hashes (not HMAC), understanding the algorithm helps when debugging signed API requests.
Tips
Hash values are case-insensitive when comparing — "3f786850e387550fdab836ed7e6dc881de23001b" and "3F786850E387550FDAB836ED7E6DC881DE23001B" are the same hash, just displayed differently. Both the tool's output and the reference hash you're comparing against should produce the same value regardless of case.
Text hashing uses UTF-8 encoding. If the tool you're comparing against uses a different encoding (UTF-16, Latin-1), the hashes will differ even for the same visible text. Make sure you're comparing like with like.
Limitations
This tool hashes text input. File hashing (computing the hash of a file on your disk) requires reading the file — which this tool does support via file upload, but note that large files may take a moment to process in the browser.
Do not use MD5 or SHA-1 for any new application where security matters. They are broken for cryptographic purposes. Use SHA-256 or SHA-512 for integrity checking, and bcrypt/Argon2 (not available here, they require server-side processing) for password storage.
Frequently Asked Questions
A cryptographic hash function takes an input of any length and produces a fixed-size output (the "hash" or "digest"). The same input always produces the same hash, but even a tiny change in the input — a single character — produces a completely different hash. This makes hashes useful for verifying data integrity, storing passwords securely, and creating digital signatures.
MD5 produces a 128-bit (32-character hex) digest and is extremely fast, but it is cryptographically broken — attackers can engineer collisions (two different inputs with the same hash). SHA-256 produces a 256-bit (64-character hex) digest, is significantly more secure, and is recommended by NIST for modern applications. Use SHA-256 or SHA-512 for security-critical tasks and MD5 only for non-security purposes like fast checksums.
No. Hash functions are designed to be one-way — it is computationally infeasible to reconstruct the original input from the hash alone. However, if the input is short or common (like a simple password), an attacker could use a "rainbow table" (a precomputed database of hashes) to look it up. This is why passwords should always be hashed with a salt and a specialized algorithm like bcrypt or Argon2, not a general-purpose hash like SHA-256.
SHA-256 is part of the SHA-2 family and has no known practical vulnerabilities. MD5 has known collision weaknesses and is considered unsafe for security purposes — real-world attacks have demonstrated that two different files can be crafted to share the same MD5 hash. For file integrity verification, code signing, certificates, and any security-sensitive application, SHA-256 is the standard minimum, with SHA-512 offering even higher security.
No. All hashing is performed entirely within your browser using JavaScript. When you select a file, it is read locally using the FileReader API. Neither the file contents nor the hash results are ever sent over the network. You can even use this tool offline after the page has loaded.