Text
Hash Generator (MD5, SHA-1, SHA-256, SHA-512)
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text or file, instantly and entirely in your browser. Free, no signup, no upload, no ads.
Type text above and the four digests appear here automatically.
All hashing runs entirely in your browser. SHA-1, SHA-256 and SHA-512 use the native Web Crypto API; MD5 uses a small built-in implementation. Nothing you type or drop is ever uploaded.
What this is and why it matters
A cryptographic hash function takes an input of any size and produces a fixed-length string of bytes, usually shown as hexadecimal. MD5 always emits 128 bits (32 hex characters), SHA-1 emits 160 bits, SHA-256 emits 256 bits, and SHA-512 emits 512 bits. The defining property is determinism paired with sensitivity: the same input always produces the same digest, but flipping a single bit anywhere in the input produces a completely different, unpredictable output. This is what makes a hash a reliable fingerprint for data.
The everyday reason this matters is integrity. When you download an operating system image, a database backup, or a software release, the publisher often posts the expected hash next to the download link. If the hash you compute locally matches theirs, you have mathematical confidence that the file arrived intact and was not truncated, corrupted in transit, or tampered with. This same fingerprinting property powers deduplication, where identical files are detected by comparing digests instead of comparing every byte, and content-addressed storage, where the hash itself becomes the file’s address.
Not all hash functions are equal in strength. MD5 and SHA-1 are cryptographically broken: researchers can deliberately construct two different inputs that share the same digest, called a collision, so they must never be used where an attacker could benefit from forging a match, such as digital signatures or certificates. They remain useful as fast, non-adversarial checksums for catching accidental corruption. For any security purpose, use SHA-256 or SHA-512, which have no known practical collision attacks and are the modern standard for signatures, blockchains, and password verifier storage.
How to use this tool
Decide whether you are hashing text or a file. For a short string — a password you want to fingerprint, an API payload, a snippet you need to compare — type or paste it directly into the text box. The four digests update live as you type, so there is no button to press and nothing is sent anywhere. Every keystroke is processed on your own machine.
To hash a file, drag it onto the drop zone or click to open the file picker. The tool reads the raw bytes of the file using the browser’s FileReader, so it hashes the exact binary content, not a text interpretation of it. This is what lets a locally computed digest match the checksum a publisher generated on their server. The file name and size are shown so you can confirm you picked the right one, and large files are processed asynchronously so the page never freezes.
Read the four result rows. Each of MD5, SHA-1, SHA-256, and SHA-512 is shown in a monospace row with its full hexadecimal digest. To compare against a checksum someone gave you, copy their value and visually match it, or paste yours using the one-click copy button on each row and compare in your notes.
Verify a download by comparing the tool’s SHA-256 output against the SHA-256 the publisher posted. If they are identical, character for character, the file is authentic and intact. If even one character differs, do not trust the file — re-download it and check again.
Examples and use cases
Verifying a downloaded ISO against its published checksum
You download a 2.4 GB Linux distribution image and the project’s website lists a SHA-256 checksum next to the download link. You drag the downloaded .iso onto this tool, wait a moment while it reads the bytes, and compare the computed SHA-256 to the published one. They match exactly, so you know the image was not corrupted mid-download and was not swapped for a tampered version on a mirror. Had a single character differed, you would re-download rather than risk installing a compromised image.
Deduplicating files by fingerprint instead of by name
You have two folders full of photos with different file names and want to know which images are actually identical. Instead of opening each pair, you hash each file and compare digests. Two files with the same SHA-256 are byte-for-byte identical no matter what they are named, so you can safely delete one copy. This is exactly how backup systems and cloud storage detect duplicates without comparing entire files against each other.
Confirming a config file has not changed
Before deploying, you record the SHA-1 of a critical configuration file. After a round of edits by a teammate, you hash it again. If the digest is unchanged, the file is provably identical and you can skip re-testing it; if it changed, you know to review the diff. Here MD5 or SHA-1 is perfectly appropriate because you are only guarding against accidental change, not a malicious adversary trying to forge a collision.
Fingerprinting an API payload for a cache key
A developer needs a short, stable identifier for a JSON request body so responses can be cached. Pasting the payload into the text box gives an SHA-256 digest that is unique to that exact content. Because the same input always yields the same hash, the digest becomes a deterministic cache key that changes only when the payload changes.
Frequently asked questions
- Are my text and files uploaded anywhere?
- No. Every hash is computed entirely inside your browser using the Web Crypto API and a built-in MD5 routine. Your text is never sent over the network, and files are read locally with the browser’s FileReader — the bytes never leave your device. You can confirm this by opening your browser’s network tab: hashing produces zero network requests. The tool works fully offline once the page has loaded.
- Can an AI chatbot compute a correct hash if I just ask it?
- No, and this is a genuinely important point. A large language model predicts the next token of text based on patterns; it does not actually run the MD5 or SHA-256 algorithm on your input. When you ask a chatbot for the hash of a string, it produces something that looks like a hexadecimal digest but is almost always wrong, because it is guessing plausible-looking output rather than executing the arithmetic the algorithm requires. Cryptographic hashing is exact, bit-precise computation with no room for approximation. Always use a real implementation — like this tool, which runs the actual algorithm in your browser — and never trust a hash a chatbot types out.
- Should I use MD5 or SHA-1 for security?
- No. Both MD5 and SHA-1 are cryptographically broken: researchers can deliberately construct two different inputs that produce the same digest (a collision), so neither is safe for digital signatures, certificates, or anything an attacker could exploit by forging a match. They are still perfectly fine as fast checksums for catching accidental corruption, where no adversary is involved — for example, verifying a file copied correctly. For any security-sensitive purpose, use SHA-256 or SHA-512, which have no known practical collision attacks.
- Why do I get different hashes for the same text in different tools?
- Usually because of invisible differences in the input. A trailing newline, a space, a different line-ending (CRLF vs LF), or a different text encoding (UTF-8 vs UTF-16) all change the bytes being hashed and therefore change the digest completely. This tool hashes text as UTF-8. When comparing against another tool, make sure both are hashing exactly the same bytes, including whitespace and encoding.
- Can I reverse a hash to get the original data back?
- No. Hash functions are one-way by design: the digest is a fixed length regardless of input size, so the original data cannot be reconstructed from it. So-called “reverse lookup” sites do not reverse anything — they simply store precomputed hashes of common inputs (like weak passwords) and look yours up in that table. Strong, unique inputs are not in any such table, which is why long random passwords and proper salting matter.
- What is the difference between the four hashes shown?
- They are different algorithms producing different-length outputs. MD5 is 128 bits (32 hex chars) and SHA-1 is 160 bits — both fast but broken for security. SHA-256 (256 bits) and SHA-512 (512 bits) are part of the SHA-2 family and are the current secure standard. SHA-512 is not simply “more secure” than SHA-256 for most uses; it is optimised for 64-bit processors and can be faster there, but both offer ample security margin. Pick SHA-256 unless you have a specific reason to prefer SHA-512.