Hash Generator
MD5, SHA-1, SHA-256 and SHA-512 for text or a file — computed in your browser.
Everything is computed in this page. Nothing you type and no file you choose is uploaded, which is the entire reason to check a sensitive file here rather than on a site that wants it on their server first.
How it works
A hash is a fixed-length fingerprint of any amount of data. The same input always gives the same digest, and changing a single bit changes roughly half the output bits — which is what makes it useful for telling whether two things are identical without comparing them byte by byte.
The overwhelmingly common use is verifying a download. A project publishes the SHA-256 of its installer; you hash the file you received and compare. If they match, the file arrived intact and was not tampered with in transit. If they do not, delete it — a mismatch is never a rounding error.
SHA-256 and SHA-512 are computed by your browser's own cryptographic implementation, which is why hashing a large file here is fast: the work happens in native code, not JavaScript, and the file is streamed through in chunks rather than loaded whole. MD5 has no such native support and is implemented in JavaScript here, because it is still what a great many projects publish.
That said: **MD5 and SHA-1 are broken for security purposes.** Both have practical collision attacks — two different files can be constructed with the same digest, and this has been demonstrated with real certificates and real PDFs. They remain perfectly good for detecting accidental corruption, which is what a checksum on a download mirror is usually guarding against. They are not adequate for anything where somebody might be trying to deceive you. Use SHA-256 for that.
Hashing is also not encryption and not compression. It is one-way and lossy: there is no operation that recovers the input from the digest. Sites offering to "decrypt" an MD5 hash are searching a table of previously-hashed common strings, which works for `password1` and never for anything with real entropy.
Common questions
Which one do I want?
SHA-256 unless something told you otherwise. Use MD5 or SHA-1 only to match a checksum a project has published in that format — plenty still do, and for catching a truncated download they are fine.
The hashes do not match. What now?
Download it again, ideally from a different mirror. Most mismatches are an interrupted or truncated transfer. If a fresh copy from a different source still disagrees with the published value, do not run it.
Can I get the original text back from a hash?
No. Hashing is one-way and throws information away — every possible input maps into the same fixed number of output bits. Sites claiming to reverse a hash are looking it up in a table of common strings they hashed in advance.
Is it safe to hash a password here?
It never leaves your browser, so nothing is transmitted. But a plain hash is the wrong tool for storing passwords in the first place — that needs a slow, salted function such as bcrypt, scrypt or Argon2, deliberately designed to be expensive to compute. A raw SHA-256 of a password is cracked at billions of guesses per second.