How to use the hash generator
Text: type or paste; all five hashes update as you type. File checksum: drop any file; the hashes are computed from its exact bytes. Tick Uppercase if the reference value you’re comparing against is uppercase (they’re equivalent).
Algorithms compared
| Algorithm | Output | Speed | Security status | Typical use |
|---|---|---|---|---|
| MD5 | 128-bit (32 hex) | Fastest | Broken since 2004 | Checksums, legacy systems |
| SHA-1 | 160-bit (40 hex) | Fast | Broken since 2017 | Git object IDs, legacy |
| SHA-256 | 256-bit (64 hex) | Fast | Secure | Certificates, Bitcoin, file integrity, signatures |
| SHA-384 | 384-bit (96 hex) | Fast | Secure | TLS, government standards |
| SHA-512 | 512-bit (128 hex) | Fast on 64-bit | Secure | High-assurance systems |
“Broken” means researchers can produce two different inputs with the same hash (a collision). That’s fatal for signatures and certificates but irrelevant for detecting accidental corruption of a download — which is why MD5 checksums still appear on download pages.
What hashes are used for
- File integrity — download pages publish a SHA-256 so you can confirm the file arrived intact and unmodified.
- Deduplication — identical files have identical hashes, so storage systems and backup tools compare hashes instead of contents.
- Version control — Git identifies every commit and file by a SHA-1 (moving to SHA-256).
- Digital signatures and certificates — the document is hashed and the hash is signed.
- Blockchains — Bitcoin’s proof-of-work is repeated SHA-256 hashing.
- Password storage — but not with these plain hashes. See below.
Hashes and passwords
Plain SHA-256 is far too fast for passwords: an attacker with a GPU can try billions per second against a stolen database. Systems should store passwords with a deliberately slow, salted algorithm — bcrypt, scrypt or Argon2 — which this page deliberately does not offer, because generating password hashes in a web page is the wrong workflow. If you need a strong password, use the password generator; if you’re a developer, use your framework’s password hashing.
Verifying a download, step by step
- On the download page, find the published checksum (often labelled SHA-256 or “sha256sum”).
- Drop the downloaded file into the File checksum tab.
- Compare the SHA-256 line with the published value. Matching the first and last eight characters is usually enough to be confident.
- If they differ, delete the file and download again — from the official source.
Frequently asked questions
What is a hash?
A fixed-length fingerprint of any input, produced by a one-way function. The same input always gives the same hash; a one-character change gives a completely different one; and you can't get the input back from the hash.
Which algorithm should I use?
SHA-256 for anything new. MD5 and SHA-1 are broken for security (collisions can be manufactured) but are still fine for checksums, cache keys and matching against existing MD5/SHA-1 values published by others.
Can I verify a downloaded file?
Yes — switch to "File checksum", drop the file, and compare the hash with the one published on the download page. Any difference means the file is corrupted or tampered with.
Is my text or file uploaded?
No. Hashing uses your browser's built-in Web Crypto API (and a small MD5 implementation) on your device. Large files are read locally and never transmitted.
Last updated August 26, 2026.