Cryptographic digest
digest = HASH(message bytes)
Hash Generator
Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of a text or any file, in hex and Base64, with one-click copy. The file is read locally and never uploaded.
- Clipboard
Source
The file is read in your browser and never uploaded.
Hashes
MD5 and SHA-1 still work as checksums, but collisions are possible: for security, use SHA-256 or stronger.
Was this tool useful?
How does this tool work?
This generator computes the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of a text or file at once, each in lowercase hex and in Base64. It is for anyone who needs to verify a download, check whether two versions of a file are identical or fill in a checksum in a script or documentation.
A hash function turns input of any size into a fixed-length digest: 128 bits for MD5, 160 bits for SHA-1, then 256, 384 and 512 bits for the SHA-2 family defined in FIPS 180-4. The same content always yields the same digest, and the smallest change produces a completely different result. For example, the SHA-256 of "hello" is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, while "hello" followed by a newline gives 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03. Text is encoded as UTF-8 before hashing, just like sha256sum and most libraries do.
SHA digests are computed with the browser's Web Crypto API; MD5, which Web Crypto does not provide, is computed by a local implementation. A file is read from your disk by the browser, without any upload, and its raw bytes are hashed, so the result matches sha256sum, certutil -hashfile or Get-FileHash. Each digest is shown in lowercase hex, the format of SHA256SUMS files, and in Base64, the format of SRI integrity attributes and the Content-Digest header (RFC 9530). MD5 and SHA-1 are flagged as unsuitable for security because practical collisions exist for both (the SHAttered SHA-1 collision dates from 2017).
How to use this tool
Enter text or choose a file
Paste text into the input area or select a file of any type: the browser reads it without sending it anywhere.
Read the five hashes
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are computed together, each in lowercase hex and in Base64; MD5 and SHA-1 carry a "checksums only" warning.
Copy the value you need
Use the copy button for the algorithm and format you want, then paste the hash into your comparison, script or documentation.
Cryptographic digest
Use cases
Verify a downloaded ISO image
Linux distributions and many vendors publish a SHA256SUMS file next to their downloads. Compute the SHA-256 of the file you received and compare it with the official value to detect a corrupted or tampered download.
Check whether a file changed after a transfer
Two files with the same SHA-256 are byte-for-byte identical. Compare the hash of a backup, an export or a contract before and after copying it to a USB drive or sending it, to confirm it was not altered.
Fill in a checksum in a script
A Homebrew formula, a Dockerfile or an install script often asks for the SHA-256 of an archive. Generate it locally and copy the exact hex or Base64 form you need.
Examples
SHA-256 digest of “abc”
Input
Source: Text; Text to hash: abc; Encoding: HexadecimalResult
SHA-256: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adTips and best practices
- A trailing space or newline changes the entire hash: if your result differs from the terminal, check that echo did not add a newline (use echo -n or printf).
- To verify a download, hash the file itself rather than its copy-pasted content: copy-paste can change line endings or encoding.
- Never store a password as a plain MD5 or SHA-256 hash: use a slow, salted function such as Argon2id, scrypt, bcrypt or PBKDF2, as the OWASP Password Storage Cheat Sheet recommends.
Sources and references
- NIST, FIPS 180-4 — Secure Hash Standard (SHS) (opens in a new tab)Page in English
- R. Rivest, RFC 1321 — The MD5 Message-Digest Algorithm (opens in a new tab), RFC Editor, 1992Page in English
Frequently asked questions
Can a SHA-256 hash be decoded or reversed?
No, a hash function is one-way and there is no decryption operation. Websites that "decode" hashes simply look the value up in tables of precomputed hashes. That works for common words or weak passwords, never for long, unknown content.
Is MD5 still safe to use?
For detecting accidental corruption, yes: MD5 remains fast and widely used as a checksum. For any security purpose (signatures, certificates, integrity against an attacker, passwords), no, because two different files with the same MD5 can be crafted in seconds. The same applies to SHA-1, at a higher cost.
What is the difference between SHA-256 and SHA-512?
Both belong to the SHA-2 family: SHA-256 outputs 256 bits (64 hex characters) and SHA-512 outputs 512 bits (128 characters). Both are secure today; SHA-256 is the most widespread, while SHA-512 is often faster on 64-bit processors. SHA-384 is a truncated variant of SHA-512, commonly used for SRI.
Why is my hash different from the command line?
The most common cause is an invisible character: a newline added by echo, Windows line endings (CRLF) instead of LF, or a trailing space. Encoding matters too, and the tool hashes text as UTF-8. For a file, hashing the file directly gives exactly the same result as sha256sum or Get-FileHash.
Can two different files have the same hash?
In theory yes, since the number of possible digests is finite: that is a collision. No SHA-256 collision has ever been found and producing one remains out of reach. For MD5 and SHA-1, collisions are practical, which is why the tool shows a warning.
Can I hash a large or confidential file?
Yes: the browser reads the file on your device and never uploads it, which suits confidential documents. The practical size limit depends on the memory available on your device. For multi-gigabyte disk images, a command-line utility remains the better choice.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Similar tools
Check whether two hashes or checksums match, regardless of case, spaces or colons.
Security & privacyUse this tool
Compute an HMAC-SHA-1, SHA-256, SHA-384 or SHA-512 in hex or Base64 and verify a webhook signature.
Security & privacyUse this tool
Generate the SRI integrity attribute of a script or stylesheet from pasted content, a file or a CDN URL.
Security & privacyUse this tool
Read next
GuideBest practicesBeginner
Subresource Integrity (SRI): verify external resource integrity
Understand how SRI hashes help detect unexpected changes to static third-party scripts and stylesheets, and where SRI does not apply.
29 August 20261 min
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 min
GuideBest practicesIntermediate
Encryption, hashing and HMAC: understand the differences
Learn when to use encryption, hashing, HMAC or key derivation for confidentiality, integrity, authentication and password handling.
23 September 20263 min
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 min