#️⃣ Hash Generator

Generate MD5, SHA-1, SHA-256 and SHA-512 hashes from text or a file. Computed entirely in your browser.

All hashing runs locally using your browser's Web Crypto API. Nothing you type or upload is ever sent to a server.

Uppercase

INPUT TEXT

Hashes

Enter text above to see its hashes.

About the Hash Generator

A cryptographic hash function turns any input — a password, a message, or an entire file — into a fixed-length string of hexadecimal characters called a digest. The same input always produces the same digest, but even a one-character change produces a completely different one. Hashes are used to verify file integrity (checksums), store passwords safely, and detect tampering. This tool computes the four most common digests — MD5, SHA-1, SHA-256 and SHA-512 — for any text or file, entirely in your browser.

SHA-1, SHA-256 and SHA-512 are computed with your browser's native SubtleCrypto (Web Crypto) API, which is fast enough to hash large files. MD5 is computed with a small JavaScript library because the Web Crypto API deliberately omits it.

How to use it

Choose Text or File mode using the tabs.
Text mode hashes as you type, with a short debounce. File mode lets you drag-and-drop a file or click to browse.
Toggle Uppercase to switch the hex output between lowercase and uppercase.
Copy any hash with the copy button next to it. The input byte size is shown so you can confirm what was hashed.

Features

⚡ Live text hashing

Hashes update as you type — no button to press, with a short debounce for performance.

📁 File drag-and-drop

Drop any file to compute its checksum. Great for verifying downloads and detecting corruption.

🔒 100% client-side

Uses the Web Crypto API in your browser. Files and text never leave your machine.

🔠 Case toggle

Show digests in lowercase or uppercase to match whatever format you're comparing against.

🧮 Four algorithms

MD5, SHA-1, SHA-256 and SHA-512 computed simultaneously from the same input.

📋 One-click copy

Each hash has its own copy button so you grab exactly the digest you need.

Frequently Asked Questions

Which hash should I use?

For verifying file integrity, SHA-256 is the modern default. MD5 and SHA-1 are fast and still widely used for checksums, but they are cryptographically broken — never use them for security-sensitive purposes like password storage or digital signatures. SHA-512 offers a larger digest and is common in high-assurance contexts.

Why is MD5 computed differently from the SHA hashes?

Browsers' built-in Web Crypto (SubtleCrypto) API supports SHA-1, SHA-256 and SHA-512 natively, but intentionally does not include MD5 because it is insecure. To still offer MD5 for checksum use, this tool computes it with a small, well-established JavaScript library — all locally, still without any server.

Can I verify a file download's checksum?

Yes. Switch to File mode, drop the downloaded file, and compare the generated hash against the checksum published by the software vendor. If they match exactly, the file is intact and untampered.

Is there a file size limit?

This tool accepts files up to 100 MB. Larger files are read entirely into memory in the browser, which can be slow or crash the tab, so the limit keeps the experience responsive. For very large files, a command-line tool like sha256sum is more suitable.

Are my text and files private?

Completely. All hashing happens in your browser using the Web Crypto API and a local library. Nothing you enter or upload is transmitted to any server or stored anywhere.

Hash generator guide: MD5, SHA-1, SHA-256 and SHA-512 in practice

A cryptographic hash function reduces any input — a word, a JSON payload, a 90 MB installer — to a fixed-length hexadecimal digest. It is deterministic, so identical bytes always produce an identical digest, and it has the avalanche property, so a one-character change rewrites the whole value. Hash this tool's sample sentence and MD5 returns 9e107d9d372bb6826bd81d3542a419d6; change the final word from dog to cog and it becomes 1055d3e698d289f2af8663725127bd4b, with no visible relationship to the first.

This tool computes MD5, SHA-1, SHA-256 and SHA-512 at the same time from the same input, so you never have to guess in advance which one a vendor published. Digest length alone identifies the algorithm: MD5 is 32 hex characters, SHA-1 is 40, SHA-256 is 64 and SHA-512 is 128. Output is lowercase by default, and the Uppercase toggle changes only how it is displayed — the underlying value is the same either way.

Hashing is not encryption, and the distinction matters more than the vocabulary suggests. Encryption is reversible with a key; hashing is one-way and lossy. SHA-256 compresses a 100 MB file into 32 bytes, so the original cannot be recovered even in principle, because the information is simply gone. When people say a hash was cracked, they mean somebody guessed an input that produces the same digest — not that anyone inverted the function.

That makes hashes excellent for one question: are these bytes identical? Download checksums, change detection in build pipelines, deduplication and content-addressed storage all reduce to that. It makes them a poor fit for two jobs they are constantly pressed into — storing passwords, which needs a deliberately slow algorithm such as Argon2id, scrypt or bcrypt, and authenticating a message, which needs HMAC with a shared secret rather than a bare digest.

MD5 and SHA-1 are both broken for adversarial use. Practical MD5 collisions have existed since 2004, and a chosen-prefix collision was used in 2008 to forge a rogue certificate authority certificate. SHA-1 fell in 2017, when the SHAttered attack published two different PDFs sharing one SHA-1, followed in 2020 by a chosen-prefix collision cheap enough to rent. Both still detect accidental corruption perfectly well; neither survives an attacker who controls the input.

How it works

SHA-1, SHA-256 and SHA-512 are computed by the browser's native SubtleCrypto (Web Crypto) implementation through crypto.subtle.digest. All three run concurrently over the same byte array, which is why switching between algorithms costs nothing here — every value is already on screen. SubtleCrypto is only exposed in a secure context, meaning HTTPS or localhost, so the tool keeps a pure-JavaScript fallback for the rare environment where crypto.subtle is undefined.

MD5 always takes the JavaScript path. The Web Crypto API deliberately omits MD5 from its algorithm list because it is not fit for cryptographic use, so a small, long-established library computes it locally instead. The result is byte-identical to what md5sum or CertUtil would print — the only difference is which code performs the arithmetic, not what the arithmetic produces.

In text mode the input is converted to bytes with TextEncoder, which always emits UTF-8, and hashing runs after a 300 ms pause in typing. The byte count shown beside the results is that UTF-8 length, not the character count, so Devanagari text or emoji report several bytes per visible character. A request-sequence guard discards any result that arrives after a newer one, so fast typing cannot leave a stale digest on screen.

File mode reads the whole file into memory with file.arrayBuffer() and hashes the raw bytes, with a 100 MB ceiling because that buffer is held in the tab. No normalisation happens at any stage — no trimming, no line-ending conversion, no BOM stripping — so the digest reflects exactly the bytes on disk, which is what makes it comparable to a published checksum.

Common uses

Verify a downloaded installer, JAR, ISO or release tarball against the SHA-256 checksum published on the vendor's site.
Confirm that two files with different names or timestamps are byte-for-byte identical, which comparing file sizes cannot prove.
Detect silent corruption after a large transfer over SFTP, S3 or a flaky VPN link.
Fingerprint a fixed input to build a deterministic cache key or a content-addressed file name.
Identify an unlabelled hash someone sent you: the character count tells you the algorithm, which resolves most checksum-mismatch tickets that turn out to be MD5 compared against SHA-256.
Produce test vectors when implementing or porting hashing code, by hashing a known string here and comparing it against Java MessageDigest, Python hashlib or Go crypto/sha256 output.
De-duplicate a folder of uploads by hashing each file and grouping identical digests.
Reproduce a digest recorded in build metadata or an artifact repository to confirm the file you have is the one that was published.

Before you rely on the result

Never treat this as password hashing. General-purpose hashes are designed to be fast, and commodity GPUs try billions of SHA-256 candidates per second. Password storage needs a slow, memory-hard algorithm — Argon2id, scrypt or bcrypt — with a unique per-user salt and a tuned work factor.
Hashing a password inside a browser page is not a security measure. Whatever the page produces becomes the effective password in transit, so anyone who captures it can replay it verbatim. Send the plaintext over TLS and hash it on the server.
A plain digest is not a message signature. Webhook verification in Stripe, GitHub and Razorpay uses HMAC-SHA256 over the raw request body with a shared secret. HMAC is not SHA-256 of the secret concatenated with the message, and that naive construction is vulnerable to length-extension on MD5, SHA-1 and SHA-256. This tool computes plain digests only.
In text mode the digest covers exactly the characters in the box, trailing newline included. This is the usual reason a value here disagrees with the shell: echo hello | sha256sum hashes six bytes, echo -n hello hashes five, and the two digests have nothing in common.
For files, line endings are content. The same source file checked out with CRLF on Windows and LF on Linux produces different hashes, which is a routine false alarm during cross-platform build verification.
A checksum published on the same page as the download only proves the file transferred intact. If the mirror itself was compromised, both were replaced together. Real provenance needs a signature — a GPG-signed checksum file verified against a key you obtained through a separate channel.
Compare digests case-insensitively. Hex is hex; the Uppercase toggle exists precisely because vendors publish in both styles, and a mismatch that disappears when you flip the case was never a mismatch.