Developer / TOOLKIT
Hash Generator
Calculate MD5, SHA-1, SHA-256 and SHA-512 digests of text or a selected file in your browser. Text uses UTF-8; a file is hashed as its original bytes.
Free to use · No account needed
Compare a file with a published checksum
- Obtain the expected checksum through a trusted publisher channel and note its algorithm.
- Select the downloaded file here. File hashing starts when the file is selected; the Generate hashes button is for the text box.
- Compare the complete digest for the same algorithm. A difference means the bytes differ; a match is useful only to the extent that you trust the expected value.
The tool loads the selected file into browser memory. For very large files, use a local command-line utility instead of assuming unlimited browser capacity.
Reproduce a small UTF-8 example
Enter exactly abc, with no newline or trailing space, and generate the hashes. The SHA-256 result should be:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
Now add a newline and run it again. The digest changes because the input bytes change. Selecting a file containing exactly the three UTF-8 bytes for abc yields the same digest as the first text example. This is a reproducible test vector, not a guarantee about every possible input.
Choose an algorithm for your task
| Task | Choose | Boundary |
|---|---|---|
| Compare a modern download checksum | The publisher’s SHA-256 or SHA-512 value | Use a trusted expected digest; hashing alone does not authenticate the publisher |
| Read a legacy checksum | MD5 or SHA-1 only if that is the published format | These algorithms are unsuitable for collision-resistant security checks |
| Store user passwords | A dedicated password-hashing implementation | This tool provides raw digests, not salted password storage |
Use a vetted password-hashing scheme such as Argon2id rather than a fast raw digest with a manually added salt. This page is for checksums and fingerprints, not a password database or digital-signature verifier.
Exact bytes, limits and privacy
Newlines, encoding, a byte-order mark and spaces can change the digest. Copying visible text out of a file is not always equivalent to hashing the file. Text input is encoded with TextEncoder; selected files use their raw bytes.
Hashing does not upload text or files. Optional site analytics follows your privacy choice. The tool has no offline installer: a loaded page can compute without a new request, but a fresh offline visit or refresh is not guaranteed.
Sources and review scope
OWASP Password Storage guidance explains dedicated password hashing; Web Cryptography API: digest describes browser digest processing. Reviewed October 11, 2026 against this implementation. The abc example is independently calculated and checked in the browser regression test.
Boundary and failure cases
A matching digest only means the bytes agree with the reference you compared against. It is not a malware scan, a publisher signature check or proof that the reference itself is trustworthy. Obtain expected checksums from the vendor's HTTPS page or signed channel.
Text mode and file mode differ when editors insert a trailing newline, a UTF-8 BOM or a different line ending. Hash the exact artifact you will distribute. MD5 and SHA-1 remain useful for non-security checksums but are not appropriate where collision resistance matters.
This page does not implement password storage, salting, key derivation or HMAC with a secret key. Do not paste production secrets into a shared browser profile.
Questions about checksums
Can I recover a password from its hash here?
Why does my text hash differ from a file hash?
Does matching a checksum prove the file is safe?
Which algorithm should I choose?
Is my input uploaded?
Scenario guides
- SHA-256 file checksum — Integrity for release files.
- Verify a download checksum — Compare publisher digests.