MD5 and SHA-1 are not secure for passwords; use bcrypt, scrypt or Argon2 to store them.
This hash generator computes MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3 and CRC32 checksums of text or files of any size at once, in hex or Base64. Paste a published checksum to verify a download, or add a key for HMAC signatures. Hashing runs in your browser with WebAssembly, so files are never uploaded.
How to use
- Type or paste text: all hashes update as you type.
- Or switch to Files and drop one or more files of any size. They are read in chunks with a progress bar.
- Tap any hash to copy it. Turn on Uppercase or Base64 to change the output format.
- Turn on HMAC and enter a secret key to get HMAC signatures instead of plain hashes.
- Paste an expected hash into Verify: the matching row is highlighted, or you see “No match”.
- Hashing runs in your browser with WebAssembly. Text, files and keys are never uploaded.
- Text is hashed as UTF-8 bytes exactly as typed, including spaces and line breaks.
- MD5 and SHA-1 are fine for checksums but broken for security. Use SHA-256, SHA-3 or BLAKE3 for anything sensitive, and a slow hash such as bcrypt or Argon2 for passwords.
- HMAC works with MD5, SHA-1, SHA-2 and SHA-3. BLAKE2b, BLAKE3 and CRC32 are hidden while HMAC is on.
- Verify ignores letter case and spaces, and also accepts Base64 values.
What a hash is for
A cryptographic hash turns any input into a fixed-length fingerprint. The same bytes always give the same hash, and changing a single bit changes about half of the output bits. SHA-256 of the word hello is 2cf24dba 5fb0a30e 26e83b2a c5b9e29e 1b161e5c 1fa7425e 73043362 938b9824 (spaces added for readability); Hello with a capital H gives a completely different value.
Common uses are verifying downloads against a published checksum, detecting duplicate files, content-addressed storage such as Git, and signing API requests with HMAC. Text is hashed as UTF-8 bytes exactly as typed, so a trailing space or a Windows line ending changes the result.
Which algorithm to choose
MD5 (128 bits) and SHA-1 (160 bits) have practical collision attacks: fine for spotting accidental corruption, not for security. SHA-256 and SHA-512 (FIPS 180-4) are the safe default for checksums and signatures. SHA-3 (FIPS 202) is a different design kept as a backup to SHA-2. BLAKE3 is a newer hash that is very fast on large files. CRC32 is a 32-bit error-detecting code used in ZIP, PNG and Ethernet; it catches transmission errors but is trivial to forge.
Hashing is not encryption
A hash cannot be decoded back to the input. Short or common inputs can still be found by guessing, which is why passwords must be stored with a slow, salted function such as Argon2, scrypt or bcrypt rather than plain SHA-256. HMAC (RFC 2104) mixes a secret key into the hash, so only someone with the key can produce or check the signature.
Frequently asked questions
How do I verify a file checksum?
Switch to Files, drop the downloaded file and paste the checksum from the publisher into Verify. The matching algorithm row turns green; if nothing matches, the file is different or corrupted.
Can a hash be reversed or decrypted?
No. A hash is a one-way function. Short inputs such as common passwords can be found by trying many guesses, but there is no key that turns a hash back into the original data.
Is MD5 still safe to use?
Only for non-security tasks such as detecting accidental changes or deduplicating files. Researchers can create different files with the same MD5, so use SHA-256 or newer for signatures and integrity against tampering.
What is the difference between SHA-256 and SHA-512?
SHA-256 outputs 256 bits (64 hex characters), SHA-512 outputs 512 bits (128 hex characters). Both belong to SHA-2 and are considered secure; SHA-512 is often faster on 64-bit processors.
Are my files uploaded to compute the hash?
No. Files are read in chunks inside your browser and hashed with WebAssembly, so even multi-gigabyte files never leave your device.
Why does my hash differ from the one in my code?
Usually the input bytes differ: an extra newline, a different text encoding, or hex versus Base64 output. Check for trailing spaces and line endings, and compare in the same format.