How to use
- Choose Text and type something — MD5, SHA-1, SHA-256, SHA-384 and SHA-512 appear instantly. Text is hashed as UTF-8 bytes.
- For a file checksum, choose File and pick or drop a file. Large files are read in pieces, so you see progress and can cancel at any time.
- Paste the value from a download page into Compare with expected hash to see which algorithm it matches. Case, spaces and prefixes like
sha256:are ignored.
Algorithms at a glance
A hash function condenses input of any size into a fixed-length value, one way only. Change a single character and the result changes completely.
| Algorithm | Output | Hex characters | Standard | For security? |
|---|---|---|---|---|
| MD5 | 128 bits | 32 | RFC 1321 | No — collisions found in 2004 |
| SHA-1 | 160 bits | 40 | FIPS 180-4 | No — practical collision published in 2017 |
| SHA-256 | 256 bits | 64 | FIPS 180-4 | Yes |
| SHA-384 | 384 bits | 96 | FIPS 180-4 | Yes |
| SHA-512 | 512 bits | 128 | FIPS 180-4 | Yes |
Example
The SHA-256 of abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, and its MD5 is 900150983cd24fb0d6963f7d28e17f72. These are the official test vectors from FIPS 180-4 and RFC 1321, so you can check the tool yourself. The SHA-256 of an empty string starts with e3b0c442 and ends with b855.
Things to watch out for
- Same characters, different bytes, different hash. Windows (CRLF) vs Unix (LF) line endings, or a trailing newline, change the result. The text box uses LF, so use File mode when you need to match a file exactly.
- Don’t store passwords as plain hashes. Even SHA-256 is fast enough to brute-force. Use a dedicated function such as bcrypt, scrypt or Argon2. Need a new password? Try the Password Generator.
- Use MD5 and SHA-1 only to catch accidental corruption. When tampering matters, use SHA-256 or stronger.
FAQ
Does it handle big files? Are they uploaded?
Files are never uploaded — the browser reads them on your device, 2 MB at a time. There’s no size limit, but all five hashes are computed in pure JavaScript, so a multi-gigabyte file can take a few minutes depending on your device.
Can a hash be reversed?
Not by computation; hashes are one-way. Short, common strings can still be looked up in precomputed tables, though, so a hash alone doesn’t keep a secret safe. If you just need to carry data as text, you want the Base64 Encoder, not a hash.