All five hashes at once
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are calculated together as you type, so you never have to run the same input five times.
Hash Generator – MD5, SHA-1, SHA-256 and SHA-512
Generate every common hash at once from text or a file. Paste a string or drop a file and this hash generator returns MD5, SHA-1, SHA-256, SHA-384 and SHA-512 together, in hex or Base64, with a built-in checksum verifier that tells you instantly whether a downloaded file matches the hash the publisher listed.
Five algorithms at onceText or file inputHex or Base64Checksum verifierFiles never leave your device
File to hashNo file selected
MD5 and SHA-1 are still fine for detecting accidental corruption, but both are broken against deliberate collision attacks. Use SHA-256 or stronger whenever the hash needs to prove that a file was not tampered with, and never store passwords with a plain fast hash.
Why use this hash generator
Most online hash tools make you pick an algorithm, click a button and wait for a page reload – and many of them send your text to a server to do it. This one does the whole job locally, in one screen.
Real file hashing
Drop an ISO, an installer or a ZIP and get its checksum without uploading a byte. The file is read directly from disk by your browser.
Built-in verifier
Paste the checksum from a download page. The tool detects which algorithm it belongs to by length and tells you plainly whether it matches.
Hex or Base64, either case
Switch encoding and letter case in one click, because APIs, config files and package managers all expect something slightly different.
Honest security labels
Each algorithm is tagged as broken or recommended, so you do not accidentally ship MD5 where a real integrity guarantee is needed.
Nothing is transmitted
Hashing uses the browser Web Crypto API and a local MD5 implementation. Your text, tokens and files are never sent, logged or stored.
How to generate or verify a hash
Choose text or file
Use the text box for strings, tokens, JSON or config values. Switch to file mode to checksum a download.
Enter your input
Type or paste the text and every hash updates instantly. For a file, drop it on the panel or tap to browse; large files show a progress state while they are read.
Pick the output format
Hex is the usual choice for checksums. Base64 is what many APIs, subresource integrity attributes and signing schemes expect. Toggle uppercase if the system you are pasting into is case-sensitive about it.
Copy the hash you need
Each row has its own copy button, or copy all five at once with the algorithm names attached.
Verify a published checksum
Paste the publisher’s hash into the verify box. The algorithm is detected from its length and the result tells you immediately whether your file or text matches.
Which hash algorithm should you use?
All of these produce a fixed-length fingerprint that changes completely if a single bit of the input changes. They differ in output size and in how well they resist deliberate attack.
MD5 128-bitFast and still common for file integrity and cache keys. Collisions can be produced deliberately, so it must not be used for signatures, certificates or passwords.
SHA-1 160-bitDeprecated since practical collisions were demonstrated in 2017. Git and some legacy systems still use it; do not choose it for anything new.
SHA-256 256-bitThe current default for checksums, certificates, blockchains and package integrity. Fast, widely supported and with no known practical attacks.
SHA-384 384-bitA truncated SHA-512 variant used in TLS cipher suites and some compliance profiles that require more than 256 bits.
SHA-512 512-bitLarger digest and often faster than SHA-256 on 64-bit hardware. A good choice for long-term integrity records.
Passwords Use bcrypt or Argon2Every algorithm here is deliberately fast, which is exactly wrong for passwords. Use a slow, salted password hash such as Argon2id, bcrypt or scrypt instead.
What you can use it for
- Verify that an ISO, installer or archive downloaded without corruption or tampering.
- Compare two files instantly by checking whether their hashes match.
- Generate a Base64 digest for a subresource integrity attribute or an API signature.
- Create deterministic cache keys, ETags or deduplication fingerprints.
- Check that a database migration or export produced identical content.
- Confirm a webhook payload matches the digest a provider sent alongside it.
- Teach or learn how a one-character change transforms an entire digest.
Hash generator FAQ
A hash is a fixed-length fingerprint calculated from any amount of data. The same input always produces the same output, a single changed character produces a completely different result, and the process cannot be reversed to recover the original data. That makes hashes ideal for checking integrity and comparing content without revealing it.
No. Hashing is one-way, so there is no key that turns a digest back into the original text. Sites advertising MD5 decryption are simply looking the value up in a huge table of precomputed common inputs, which works only for short, unsalted, predictable strings and never for arbitrary data.
MD5 is fine for spotting accidental corruption, such as a truncated download or a duplicate file, and it is still used for cache keys. It is not safe where an attacker could benefit from forging a match, because two different files with the same MD5 can be created on demand. Use SHA-256 for anything security-relevant.
Switch to file mode, drop the downloaded file onto the panel, then paste the checksum from the publisher into the verify box. The tool works out which algorithm the hash belongs to from its length and compares it. A match means the file is byte-for-byte identical to the one that was published.
No. SHA hashing uses the browser Web Crypto API and MD5 runs in local JavaScript, so everything happens on your own device. Nothing is transmitted, logged or stored, which makes the tool safe for internal documents, API keys and anything else you would not paste into a remote service.
Almost always because the input differs slightly. A trailing newline, a carriage return from a Windows file, a different character encoding or an invisible space will change the digest completely. Text here is hashed as UTF-8 with no added characters, which matches what command line tools produce for the same bytes.
No. SHA-256 is designed to be fast, which lets an attacker test billions of guesses per second against a stolen database. Passwords need a deliberately slow, salted algorithm such as Argon2id, bcrypt or scrypt, all of which are built into modern frameworks.
They encode the same bytes in different alphabets. Hex uses sixteen characters and is what checksum files and command line tools print, while Base64 packs the same digest into roughly a third fewer characters and is what subresource integrity attributes, HTTP digest headers and many APIs expect.
Hash it, check it, move on
Five algorithms, text or file input, hex or Base64, and a verifier that answers the only question that matters: does it match? Free, unlimited and completely private.