Hash Generator
Get the MD5, SHA-1, SHA-256, SHA-384, SHA-512 and SHA3-256 hash of any text or file, and check it against the hash you expect. Files are hashed in your browser and never uploaded.
Input
Text is hashed as UTF-8. Spaces and line breaks change the result.
Verify a hash
Hashes
-
Checksums only. Broken for security.
-
Legacy. Do not use for new security work.
-
The common default for checksums and signatures.
-
Truncated SHA-512.
-
Longest SHA-2 digest.
-
Newer Keccak-based standard.
How to generate and verify a hash
- Choose Text or File. Type or paste text, or drop a file of up to 200 MB. The file is read by your browser and never uploaded.
- All six hashes appear at once: MD5, SHA-1, SHA-256, SHA-384, SHA-512 and SHA3-256. Tick Uppercase hex if the place you paste into wants capitals.
- To check a download, paste the checksum from the publisher's page into Verify a hash. The tool names the algorithm that matches, or says none does.
- Copy any hash with the button beside it. To check a token signed with HS256 or RS256, use JWT Decoder.
Frequently asked questions
What is a hash?
A hash is a fixed-length fingerprint of some data. The same input always gives the same hash, and changing one byte gives a completely different one. SHA-256 always gives 64 hex characters, whether the input is one letter or a 200 MB file.
Sources: NIST, FIPS 180-4: Secure Hash Standard
How do I verify a file checksum?
Drop the file here, paste the checksum from the download page into Verify a hash, and look for Match. No match means the file is damaged, incomplete or not the one the publisher released, so download it again from the official site. Capitals and spaces around the pasted value do not matter.
Can a hash be reversed or decrypted?
No. A hash is not encryption and has no key, so there is nothing to decrypt. Attackers guess instead: they hash huge lists of likely inputs and look for a match, which is why the hash of a short or common password is found quickly.
Is MD5 still safe to use?
Not for security. Two different files can be made with the same MD5, and RFC 6151 says MD5 should not be used where collision resistance matters, such as digital signatures. It still spots accidental corruption. SHA-1 has the same weakness: a real collision was published in 2017, and NIST plans to retire SHA-1 by 31 December 2030.
Sources: IETF, RFC 6151: MD5 security considerations; CWI and Google, SHAttered: the first SHA-1 collision; NIST, Transitioning away from SHA-1
Which hash should I use?
SHA-256, unless something asks for another one. It is the common choice for checksums, software downloads and signatures. SHA-384, SHA-512 and SHA3-256 are also secure. Use MD5 and SHA-1 only to match old checksums.
Can I store passwords as SHA-256 hashes?
No. SHA-256 is built to be fast, and speed helps anyone guessing passwords. Use a slow, salted password hash instead. OWASP recommends Argon2id, with scrypt, bcrypt or PBKDF2 as alternatives.
Sources: OWASP, Password Storage Cheat Sheet
Why does my hash not match another tool?
The input almost always differs by something you cannot see: a trailing space, a final line break, or a Windows line ending instead of a plain one. This tool hashes text as UTF-8, exactly as typed. For files, hash the file itself rather than text copied out of it.