Free Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files. Verify file integrity instantly — everything runs in your browser.
Algorithm
256-bit · Recommended — secure, widely supported
SHA-256 Hash
Verify / Compare Hash
Paste a known hash to check if it matches the generated hash above.
All hashing runs in your browser using the native Web Crypto API. No data is sent to any server.
Frequently Asked Questions
What is a cryptographic hash?+
A hash function takes any input (text or file) and produces a fixed-length string of characters (the hash or digest). The same input always produces the same output. Changing even one character of the input completely changes the hash. Hashes are one-way — you cannot recover the original input from the hash.
What is SHA-256 used for?+
SHA-256 (Secure Hash Algorithm 256-bit) is used for verifying file integrity, in blockchain and cryptocurrency (Bitcoin uses SHA-256), digital signatures, SSL/TLS certificates, and password hashing (when combined with a salt). It produces a 64-character hex string and is considered cryptographically secure.
Is MD5 secure?+
No — MD5 is cryptographically broken and should not be used for security purposes. Collision attacks (two different inputs producing the same hash) are practical. MD5 is still useful for non-security purposes like checking file integrity in trusted environments or checksums in data pipelines. For passwords, certificates, or security-critical applications, use SHA-256 or SHA-512.
What is the difference between MD5, SHA-1, and SHA-256?+
MD5 (128-bit) and SHA-1 (160-bit) are older algorithms with known cryptographic weaknesses — both are broken for security use. SHA-256 and SHA-512 are part of the SHA-2 family, which remains secure. The number indicates the output size in bits: SHA-256 produces a 64-character hex string, SHA-512 produces a 128-character hex string. Longer output = harder to find collisions.
How do I verify a downloaded file with a hash?+
The website or source providing the file typically lists the expected SHA-256 (or MD5) hash next to the download. After downloading, use this tool to upload the file and generate its SHA-256 hash. If the generated hash matches the listed hash exactly (character for character), the file is unmodified and authentic.
Can I hash a file without uploading it to a server?+
Yes — this tool processes everything locally in your browser using the Web Crypto API. Your file data is never sent to any server. This is important for sensitive documents or proprietary files where you need to verify integrity without exposing content.
Cryptographic Hash Functions: What They Are and When to Use Each
A hash function takes any input — a word, a document, a 10 GB video file — and produces a fixed-length string of characters called a hash or digest. The same input always produces the same hash. Change a single character of the input and the hash changes completely and unpredictably. This deterministic, one-way property makes hash functions essential for verifying integrity, storing passwords, and building data structures like hash tables and Merkle trees.
When to use SHA-256 (the default choice)
SHA-256 is the current standard for most security-relevant hashing. Use it for verifying file downloads, generating checksums for deployment artifacts, signing commits (Git uses SHA-1 by default but is migrating to SHA-256), and anywhere you need a reliable fingerprint. It is supported natively by all modern browsers via the Web Crypto API, making it fast and universally available. The output is 64 hexadecimal characters (256 bits). Use this alongside the Password Generator when building secure authentication systems.
MD5: still useful, but not for security
MD5 was designed in 1992 and is now cryptographically broken — collision attacks (generating two different inputs with the same hash) can be computed in seconds on modern hardware. Never use MD5 for password hashing, digital signatures, or certificate generation. However, MD5 remains widely used for non-security checksums: verifying that a file was not corrupted in transit, generating cache keys, deduplicating database records, and checksums in data pipelines where collision attacks are not a threat model. Many software downloads still list MD5 checksums for quick integrity verification in environments where SHA-256 is not available.
Hashing files in-browser: how it works and why it matters
This tool uses the browser's File API and the Web Crypto API to hash files entirely in-browser. When you select a file, it is read into memory as an ArrayBuffer and passed directly to crypto.subtle.digest() — no server involved, no upload, no network request. This means you can hash sensitive files (medical records, confidential documents, proprietary code) without any privacy risk. The SHA algorithms (SHA-1 through SHA-512) are native browser operations. MD5 is computed via a pure JavaScript implementation since the Web Crypto API intentionally excludes broken algorithms. For Base64 encoding of binary data, see the Base64 Encoder/Decoder.