Hash Generator

Get the checksum of a file or a piece of text

Hash Generator calculates five fingerprints at once — SHA-256, SHA-384, SHA-512, SHA-1 and MD5 — for text you type or a file you choose. The same input always gives the same hash, and changing one character gives a completely different one — which is why hashes can show that a download or copy is intact.

The SHA hashes come from your browser’s built-in Web Crypto functions, and MD5, which browsers don’t provide, is calculated by the page’s own code. Files are read on your device and never uploaded.

How to generate a hash and check it

1. Choose Text or File at the top.
2. For text, type or paste it into the box; the hashes appear as you type. For a file, click the upload area or drag the file onto it.
3. Tick Uppercase output if you need the hash in capital letters; the comparison ignores case either way.
4. To verify a download, paste the published checksum into “Compare with an expected hash”. The matching row is marked Matches, or you are told nothing matched.
5. Click the copy button beside any row to copy that hash.

Reading the five hashes

• Hexadecimal output: each hash is shown as digits 0–9 and letters a–f, lowercase unless you tick Uppercase output.
• Length tells you the algorithm: MD5 is 32 characters, SHA-1 40, SHA-256 64, SHA-384 96 and SHA-512 128.
• Warnings: SHA-1 and MD5 are labelled as fine for checksums only, because both can be deliberately faked.
• Comparison is forgiving: capital letters and spaces in the pasted hash are ignored, and it’s checked against all five rows.

Reasons to hash something

• Verifying a download: compare an installer or disk image with the SHA-256 checksum on the publisher’s site.
• Spotting changed files: two files with the same SHA-256 are, for practical purposes, identical.
• Testing your own code: check that an app produces the expected hash for a known string.

Hashes, encryption and older algorithms

Hashing is not encryption

Encryption is designed to be reversed by someone with the key. A hash can’t be turned back into the original input; it is a one-way fingerprint. That also means you can’t “decrypt” a hash here, and a hash alone won’t hide short, guessable text such as a common password, because anyone can hash candidates and compare.

When MD5 and SHA-1 are still acceptable

Researchers can create two different inputs with the same MD5 or SHA-1 hash, so neither should protect anything an attacker might tamper with — signatures, certificates or passwords. To catch accidental damage, such as a corrupted download, they still work. For anything security-related, use SHA-256 or higher.

Hash Generator: common questions