MD5 and SHA-1 are not secure for passwords; use bcrypt, scrypt or Argon2 to store them.
CRC32 is an 8-hex-digit checksum (32 bits) from the polynomial 0x04C11DB7, used by ZIP, gzip, PNG and Ethernet frames. The CRC32 of hello is 3610a686. It reliably catches random transmission errors, but anyone can forge a matching value, so it is no security check.
How to use
- Type or paste text: all hashes update as you type.
- Or switch to Files and drop one or more files of any size. They are read in chunks with a progress bar.
- Tap any hash to copy it. Turn on Uppercase or Base64 to change the output format.
- Turn on HMAC and enter a secret key to get HMAC signatures instead of plain hashes.
- Paste an expected hash into Verify: the matching row is highlighted, or you see “No match”.
- Hashing runs in your browser with WebAssembly. Text, files and keys are never uploaded.
- Text is hashed as UTF-8 bytes exactly as typed, including spaces and line breaks.
- MD5 and SHA-1 are fine for checksums but broken for security. Use SHA-256, SHA-3 or BLAKE3 for anything sensitive, and a slow hash such as bcrypt or Argon2 for passwords.
- HMAC works with MD5, SHA-1, SHA-2 and SHA-3. BLAKE2b, BLAKE3 and CRC32 are hidden while HMAC is on.
- Verify ignores letter case and spaces, and also accepts Base64 values.
What a hash is for
A cryptographic hash turns any input into a fixed-length fingerprint. The same bytes always give the same hash, and changing a single bit changes about half of the output bits. SHA-256 of the word hello is 2cf24dba 5fb0a30e 26e83b2a c5b9e29e 1b161e5c 1fa7425e 73043362 938b9824 (spaces added for readability); Hello with a capital H gives a completely different value.
Common uses are verifying downloads against a published checksum, detecting duplicate files, content-addressed storage such as Git, and signing API requests with HMAC. Text is hashed as UTF-8 bytes exactly as typed, so a trailing space or a Windows line ending changes the result.
Which algorithm to choose
MD5 (128 bits) and SHA-1 (160 bits) have practical collision attacks: fine for spotting accidental corruption, not for security. SHA-256 and SHA-512 (FIPS 180-4) are the safe default for checksums and signatures. SHA-3 (FIPS 202) is a different design kept as a backup to SHA-2. BLAKE3 is a newer hash that is very fast on large files. CRC32 is a 32-bit error-detecting code used in ZIP, PNG and Ethernet; it catches transmission errors but is trivial to forge.
Hashing is not encryption
A hash cannot be decoded back to the input. Short or common inputs can still be found by guessing, which is why passwords must be stored with a slow, salted function such as Argon2, scrypt or bcrypt rather than plain SHA-256. HMAC (RFC 2104) mixes a secret key into the hash, so only someone with the key can produce or check the signature.
Frequently asked questions
How do I verify a file checksum?
Switch to Files, drop the downloaded file and paste the checksum from the publisher into Verify. The matching algorithm row turns green; if nothing matches, the file is different or corrupted.
Can a hash be reversed or decrypted?
No. A hash is a one-way function. Short inputs such as common passwords can be found by trying many guesses, but there is no key that turns a hash back into the original data.
Is MD5 still safe to use?
Only for non-security tasks such as detecting accidental changes or deduplicating files. Researchers can create different files with the same MD5, so use SHA-256 or newer for signatures and integrity against tampering.
What is the difference between SHA-256 and SHA-512?
SHA-256 outputs 256 bits (64 hex characters), SHA-512 outputs 512 bits (128 hex characters). Both belong to SHA-2 and are considered secure; SHA-512 is often faster on 64-bit processors.
Are my files uploaded to compute the hash?
No. Files are read in chunks inside your browser and hashed with WebAssembly, so even multi-gigabyte files never leave your device.
Why does my hash differ from the one in my code?
Usually the input bytes differ: an extra newline, a different text encoding, or hex versus Base64 output. Check for trailing spaces and line endings, and compare in the same format.