Utilia
Categories ▾
Language: en ▾

Hash Generator

Generate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files of any size, and verify checksums. Everything runs in your browser.

Hash
Text is encoded as UTF-8.
Algorithms

How to use the hash generator

  1. Under Hash, choose Text or Files.
  2. For text, type or paste it in Text to hash. The hashes update as you type; the Hash button recalculates them on demand.
  3. For files, drop one or more files on the drop zone or click it to choose them. A progress bar appears for large files, with a Cancel button.
  4. Select the Algorithms you need (MD5, SHA-1, SHA-256, SHA-512) and the Output format: lowercase hexadecimal, uppercase hexadecimal or Base64.
  5. To verify a download, paste the published checksum into Compare with an expected hash (optional). The tool tells you which algorithm matches, or that none does.

What is a hash?

A cryptographic hash function turns any input, whether a word or a 50 GB disk image, into a short fixed-size fingerprint. The same input always gives the same hash, and changing a single bit of the input changes the result completely. You cannot reverse a hash to get the input back.

Algorithm Output size Hex length Status
MD5 128 bits 32 characters Broken: checksums only
SHA-1 160 bits 40 characters Broken: collisions demonstrated in 2017
SHA-256 256 bits 64 characters Secure, the current standard
SHA-512 512 bits 128 characters Secure, often faster on 64-bit processors

For example, the SHA-256 hash of abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.

Verifying a download

Software publishers often list a SHA-256 checksum next to their files. After downloading, open the Files mode, drop the file, and paste the published value into the comparison field. A match proves that the file was not corrupted during the download and is identical to the one the publisher hashed. It does not prove that the publisher is trustworthy. For that, the checksum itself must come from a trusted source, such as an HTTPS site or a signed release.

How large files are handled

Files are read locally and never uploaded. Files up to 64 MB are hashed in one pass with your browser’s built-in Web Crypto API. Larger files are read in 4 MB chunks and fed to incremental hash functions, so memory use stays flat and files of several gigabytes can be hashed. On a typical computer, expect a few hundred megabytes per second for SHA-256.

Text, encodings and line endings

A hash is computed over bytes, not characters. This tool encodes text as UTF-8, the standard on the web and in most programming languages. If you get a different result elsewhere, check for hidden differences: a trailing newline (echo "abc" | sha256sum hashes abc\n; use echo -n), Windows line endings (\r\n), or another encoding such as UTF-16.

Frequently asked questions

Can I use MD5 or SHA-1 to store passwords?

No, and not plain SHA-256 either. These functions are designed to be fast, so an attacker can test billions of guesses per second. Passwords need a slow, salted algorithm such as Argon2, bcrypt or scrypt.

Is MD5 still useful?

Yes, for detecting accidental corruption, deduplicating files or matching an old checksum list. It must not be relied on against deliberate tampering, because anyone can create two different files with the same MD5.

Are my files uploaded?

No. The files are read and hashed by your browser. Nothing is sent to a server, so you can hash confidential documents.

Why doesn't my hash match the one from the command line?

The input is almost always different: a trailing newline, spaces, line endings or text encoding. For files, make sure the download is complete. A single missing byte gives a completely different hash.

What is the difference between hex and Base64 output?

They are two ways to write the same bytes. Hexadecimal is the usual format for checksums; Base64 is shorter and is used, for example, in Subresource Integrity (sha256-…) attributes. The comparison field accepts either.

Related tools