Hash Generator

Compute SHA-256, SHA-384, SHA-512, SHA-1 and MD5 digests of text or a file.

Private by design. Your input never leaves this browser. Conversions run locally on your device.

What this tool handles

SHA-256, SHA-384, SHA-512, SHA-1 and MD5, printed as lowercase or uppercase hex.
SHA-256 is 64 hex characters, SHA-512 is 128, SHA-1 is 40 and MD5 is 32.
SHA family digests come from the browser's own Web Crypto API; MD5 comes from a bundled library.
A file is hashed from its bytes rather than its text, so any file type works.
MD5 and SHA-1 are marked in the options: both are broken for collision resistance and unfit for signatures or passwords.

Example

Text

hello world

Digests

SHA-256  b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-512  309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f
MD5      5eb63bbbe01eeed093cb22bb8f5acdc3

When you would use it

Verifying a download against its checksum — Drop the file onto the input and compare the SHA-256 digest with the one the project publishes next to the release. A file larger than 10 MiB is declined rather than read.
Proving two files are byte-identical — Hash each one and compare the hex: matching SHA-256 digests mean the bytes match, including anything a visual diff would not show. Tick several algorithms to get every digest from one pass over the input.
Matching a vendor list printed in capitals — Hex digests are often published uppercase, and a string comparison cares. "Uppercase output" reprints the same digest in capitals so the two lines can be diffed directly.
Content addressing and ETag values — The same bytes always produce the same digest, which is what makes a hash usable as a cache key, an ETag or a deduplication key for stored objects.

Common questions

Is hashing the same as encryption?

No. A hash takes no key and runs one way only: it maps any input to a fixed-length digest, and no operation turns that digest back into the original bytes. Encryption is reversible by whoever holds the key.

Is MD5 safe for storing passwords?

No, and nor is plain SHA-256. Both are built to be fast, which is exactly what someone guessing billions of passwords wants; password storage needs a slow salted function such as argon2, scrypt or bcrypt.

Can I still use MD5 or SHA-1 for anything?

Only as a non-adversarial checksum — catching a corrupted transfer, or matching a value a legacy system already stores. Collisions can be manufactured on demand for both, MD5 in seconds and SHA-1 since the 2017 SHAttered attack, so neither proves that a file has not been tampered with.

Why does my digest differ from the one I was given?

Hashing covers exact bytes, so a trailing newline, CRLF line endings or a stray space changes the result completely. That is the usual cause when two people hash what looks like the same pasted text.

Related tools

JWT Decoder — Decode a JSON Web Token header and payload locally. Signatures are not verified.
Base64 Encode / Decode — Encode and decode Base64 and Base64URL with correct UTF-8 handling.
URL Encode / Decode — Percent-encode or decode text, or break a full URL into its parts.
cURL → code — Translate a cURL command into fetch, axios or Python requests code.

Browse all 25 tools