Hash Generator Online Free
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any text or file instantly. No signup, runs entirely in your browser — your data never leaves your device.
⏱ 9 min read · Complete guide below
Type or paste text above — all five hashes appear instantly.
How the Hash Generator Works
- 1Choose Text Input to hash a string, or File Hash to compute the checksum of any file on your device.
- 2For text, type or paste into the box — all five hashes update live as you type. For files, drag and drop or click to browse.
- 3Each algorithm row shows its hash digest. Click Copy next to any algorithm to copy just that hash, or Copy all to copy all five at once.
- 4To verify a file checksum, compare the hash shown here with the value published by the file's author — they must match exactly, character for character.
Which Hash Algorithm Should You Use?
For any new security-sensitive application, use SHA-256 as the default. It is widely supported, fast, and provides 128 bits of collision resistance — more than sufficient for the foreseeable future. SHA-512 offers a larger safety margin and can be faster than SHA-256 on 64-bit CPUs due to wider internal registers.
Avoid MD5 and SHA-1 for anything security-related. Both are broken against collision attacks: an attacker can craft two different inputs that produce the same hash. For non-security uses — detecting accidental file corruption, de-duplicating cache entries, generating stable IDs for content-addressed storage — MD5 and SHA-1 remain fast and practical because a deliberate adversary is not involved.
Tips for Working with Hash Values
Always compare the full hash
When verifying a downloaded file, compare all 64 characters of a SHA-256 hash — not just the first few. Partial matches are meaningless; even one different character means the file does not match.
Case does not matter
Hex hash digests use the digits 0–9 and letters a–f. Uppercase (A–F) and lowercase (a–f) represent the same value. This tool outputs lowercase, which is the most common convention, but comparison against uppercase hashes is still valid.
Hash passwords with a KDF, not SHA
Never hash passwords directly with SHA-256 or MD5. Use a dedicated key derivation function (KDF) like bcrypt, scrypt, or Argon2, which add salting and intentional slowness to prevent brute-force attacks. SHA and MD5 are far too fast for password storage.
Verify download integrity
After downloading software, ISOs, or large files, check the SHA-256 checksum against the value published on the official site. This confirms the file arrived intact and was not tampered with in transit or on the download server.
Hashing encodes, not encrypts
Hashing is a one-way function — you cannot recover the original input from a hash. If you need to reverse the transformation (i.e., decrypt), you need encryption (AES, RSA), not hashing. Use Base64 for reversible encoding of binary data.
Identical files always produce identical hashes
If two files produce the same SHA-256 hash, they are byte-for-byte identical with overwhelming probability (a deliberate SHA-256 collision has never been demonstrated publicly). This makes hash comparison a reliable way to de-duplicate files.
How Hash Functions Actually Work
A cryptographic hash function is a mathematical machine that takes any input — a word, a document, a multi-gigabyte file — and boils it down to a fixed-length string of characters called a digest. What makes these functions so useful is a specific set of properties. They are deterministic: the same input always yields the same hash, which is what makes them usable for verification. They produce a fixed-length output regardless of input size, so a one-line message and an entire film both hash to (for SHA-256) 64 hex characters.
Three more properties give them their power. They are one-way — it is computationally infeasible to reverse a hash back into its input, which is the crucial difference between hashing and encryption. They exhibit the avalanche effect: change a single character of the input and roughly half the output bits flip, producing a completely unrelated-looking hash, so you cannot infer anything about the input from small differences. And a good hash is collision resistant: it should be practically impossible to find two different inputs that produce the same hash. That last property is the one that, when it fails, breaks an algorithm — as happened to the older hashes here.
Where Hashing Is Used
Hash functions are quietly everywhere in computing. The most visible use is file integrity: software publishers post the hash of a download so you can confirm the file you received is byte-for-byte identical to the original — a single altered character means corruption or tampering. Closely related is password storage: well-designed systems never store your actual password, only a hash of it, so a database breach does not directly expose passwords (though passwords specifically need a slow, salted function like bcrypt or Argon2, not a plain fast SHA).
Beyond those, hashing underpins digital signatures and certificates (you sign the hash of a document, not the whole thing), the blockchain (each block references the hash of the previous one, making the chain tamper-evident), and version control — every Git commitis identified by the SHA hash of its contents, which is how Git detects any change. Programmers also use fast, non-cryptographic hashes inside hash tables to look data up in constant time, and use hashing to deduplicate files by comparing digests instead of contents. The same simple idea — a compact, deterministic fingerprint of data — solves a remarkable range of problems.
The Story of Broken Hashes
Not all of the algorithms this tool offers are still safe, and the reason is a fascinating cautionary tale. MD5, designed in 1991, was once ubiquitous, but researchers gradually found ways to deliberately engineer collisions — two different inputs with the same hash. This moved from theory to real-world attack: the Flame espionage malware exploited an MD5 collision to forge a digital certificate and disguise itself as legitimate software. Once an attacker can produce collisions on demand, any security use that relies on the hash being unique is broken.
SHA-1 followed the same path. Long suspected to be weak, it was decisively broken in 2017 when researchers demonstrated the first practical collision (dubbed “SHAttered”), producing two different PDF files with the same SHA-1 hash. The industry has since migrated to the SHA-2family — SHA-256, SHA-384, SHA-512 — which remain secure, with the newer SHA-3 available as an alternative built on entirely different internals. The practical takeaways are clear: use SHA-256(or SHA-512) as your default for anything security-related, treat MD5 and SHA-1 as suitable only for non-adversarial tasks like detecting accidental corruption or generating cache keys, and remember that hashing is not encryption — it is a one-way fingerprint, not a reversible secret. Because this tool computes every hash locally in your browser via the Web Crypto API, you can even hash sensitive data safely, since nothing is ever uploaded.
Frequently Asked Questions
What is a cryptographic hash and what is it used for?
A cryptographic hash function takes any input (text, file, binary data) and produces a fixed-length output called a digest or hash. Even a tiny change to the input produces a completely different hash. This makes hashes useful for verifying file integrity (checking a downloaded file matches its published checksum), storing passwords securely, and as building blocks in digital signatures and certificates.
What is the difference between MD5, SHA-1, SHA-256, SHA-384, and SHA-512?
All five are hash algorithms, but they differ in security and output length. MD5 produces a 128-bit (32 hex character) digest and is now considered cryptographically broken — collisions can be generated deliberately. SHA-1 produces 160 bits and is also deprecated for security uses. SHA-256 (256 bits), SHA-384 (384 bits), and SHA-512 (512 bits) are members of the SHA-2 family and remain secure for current use. SHA-256 is the most widely deployed; SHA-512 offers a larger safety margin.
How does the hash generator work in the browser?
SHA-1, SHA-256, SHA-384, and SHA-512 hashes are computed using the browser's built-in Web Crypto API (window.crypto.subtle.digest), which is implemented in native code and available in all modern browsers. MD5 is computed using a pure JavaScript implementation of RFC 1321, since the Web Crypto API does not include MD5. For files, the FileReader API reads the file as an ArrayBuffer in memory before hashing — the file is never uploaded.
Is my text or file sent to a server?
No. Everything happens inside your browser. Text is encoded to bytes using the TextEncoder API, and files are read using FileReader. Neither is transmitted anywhere. You can disconnect from the internet after the page loads and the tool will still work correctly.
Should I still use MD5 or SHA-1?
Not for security-sensitive purposes. MD5 and SHA-1 are vulnerable to collision attacks — meaning two different inputs can be crafted to produce the same hash. They should not be used for password hashing, code signing, or TLS certificates. They are still fine for non-security uses like detecting accidental file corruption or generating cache keys, where a malicious actor is not trying to forge a collision.
What is a file checksum and how do I verify one?
A checksum is the hash of a file published by the file's author alongside the download. To verify a downloaded file, switch to the File Hash tab, drop the downloaded file in, and compare the SHA-256 (or whichever algorithm the publisher used) with the published value. If they match character-for-character, the file is intact. If even one character differs, the file has been modified or corrupted.
Why does the same text always produce the same hash?
Hash functions are deterministic — given the same input, they always produce the same output. This determinism is what makes them useful for verification. "Hello" will always hash to the same SHA-256 value. However, adding a single space or changing one letter completely changes the hash — a property called the avalanche effect.
What is the maximum file size the tool can handle?
The file is loaded entirely into browser memory before hashing, so the practical limit is determined by available RAM — typically several hundred megabytes to a few gigabytes on modern devices. Very large files (multi-GB video files, disk images) may cause the tab to run out of memory. For those, a command-line tool like sha256sum (Linux/macOS) or Get-FileHash (Windows PowerShell) is more appropriate.