Toolsel

Hash Generator

Runs in your browser

Generate MD5, SHA-1, SHA-256 and SHA-512 hashes from text or a file.

MD5
—
SHA-1
—
SHA-256
—
SHA-512
—

What is a Hash Generator?

A hash function takes any input — a password, a file, a block of text — and produces a fixed-length string that acts as its fingerprint. Change one byte of the input and the output changes completely; feed the same input in twice and you get the same fingerprint every time. That makes hashes useful for verifying that a downloaded file matches the original, or storing a value without storing the value itself.

MD5 and SHA-1 are fast but broken for security purposes — both have known collision attacks, meaning two different inputs can be crafted to produce the same hash. They still show up constantly for file checksums and legacy systems, which is why they are offered here, but neither should protect anything sensitive. SHA-256 and SHA-512 have no known practical collision attack and are the standard choice today, used everywhere from Git commit IDs to TLS certificates.

How to use it

  1. Choose Text or File as your input source.
  2. For text, type or paste directly. For a file, drop it onto the panel or click to browse — the file is read locally and never uploaded.
  3. All four hashes generate at once. Copy the one you need with the button beside it.
  4. Use the checksum to verify integrity: hash the file you downloaded and compare it against the checksum the publisher provided. Any difference, even one bit, means the file was altered or corrupted in transit.

Example

Text input

Input
"Hello, world!"
Output
MD5: 6cd3556deb0da54bca060b4c39479839
SHA-256: 315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3

Frequently asked questions

Is MD5 secure?
No. MD5 is cryptographically broken — practical collision attacks have existed since 2004, meaning an attacker can construct two different files with the same MD5 hash. It is still fine for detecting accidental corruption, but never use it for passwords, signatures, or anything where an adversary might try to forge a match.
Which hash should I use?
SHA-256 for almost everything today: file integrity checks, git-style content addressing, and general-purpose fingerprinting. SHA-512 is a reasonable alternative with a larger output. Reach for MD5 or SHA-1 only when you are matching an existing checksum that was already generated with one of them.
Can a hash be reversed back to the original input?
Not by design — a cryptographic hash is one-way. What defeats weak inputs is guessing: if a password is short or common, an attacker can hash millions of guesses and look for a match. That is why raw SHA-256 is a poor way to store passwords; a purpose-built algorithm like bcrypt or argon2, which is deliberately slow, is a better fit for that case.
Are file hashes computed locally?
Yes. The file is read with the File API and hashed with your browser's own SubtleCrypto engine (for SHA) or an in-browser implementation (for MD5). It is never sent anywhere, which matters if you are checksumming something sensitive.
Why do MD5 and SHA-1 produce shorter output than SHA-256?
Output length is fixed by the algorithm: MD5 always produces 128 bits (32 hex characters), SHA-1 produces 160 bits (40 characters), SHA-256 produces 256 bits (64 characters), and SHA-512 produces 512 bits (128 characters) — regardless of how long the input was.