Hash generator: MD5, SHA-1, SHA-256 and SHA-512

How to hash text or verify a file

1. Type or paste text to see all five hashes update as you type. Text is converted to UTF-8 bytes first, as almost every other tool does.
2. Or drop a file. It is read and hashed in your browser. Nothing is uploaded, so you can safely check private documents and large downloads.
3. To verify a download, paste the checksum from the publisher's site into the compare box. The tool checks it against every algorithm, ignores upper or lower case, and shows Match or No match.
4. Choose Hex or Base64. Hex is the usual format for checksums. Base64 is shorter and is used in places such as Subresource Integrity (integrity="sha384-…").

What a hash function does

A cryptographic hash turns any input into a short, fixed-length fingerprint. The same input always gives the same hash. Changing a single bit gives a completely different hash. And you can't work back from the hash to the input.

Worked example

SHA-256("abc") = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
SHA-256("abd") = a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9
MD5("abc")     = 900150983cd24fb0d6963f7d28e17f72

One letter changed, and the whole hash changed. The first and last values are the official test vectors from FIPS 180-4 and RFC 1321, so you can type abc above to check this tool.

Which algorithm should you use?

MD5 and SHA-1 are broken for security. An attacker can create two different files with the same hash. Don't use them for signatures, certificates or to prove that a file hasn't been tampered with. They are still fine for spotting accidental damage, such as a corrupted download, and for matching old checksums.

For integrity, use SHA-256 or stronger. A hash only proves integrity if you get the expected value from a trusted source, such as the publisher's HTTPS site. A checksum stored next to the file on the same server can be replaced along with the file.

Never use a plain hash for passwords

SHA-256 is designed to be fast. A modern graphics card can try billions of guesses per second against a fast hash. Even with a salt, plain SHA-256 is not good enough for stored passwords. Use a dedicated password hashing function, which is slow on purpose and uses a unique salt per password:

• Argon2id, the first choice for new systems.
• scrypt, which also uses a lot of memory.
• bcrypt, widely supported and still acceptable.

To create a strong password in the first place, use the password generator.

Tips

• Line endings matter. "hello" and "hello" plus a line break have different hashes. Command-line tools such as echo add a line break unless you use echo -n.
• Check from the command line: sha256sum file on Linux, shasum -a 256 file on macOS, or certutil -hashfile file SHA256 on Windows.
• Large files are read into memory. Files of a few hundred megabytes are fine on most computers.

Frequently asked questions

Last updated 11 October 2026. How we check our tools.