Hash Generator
Compute MD5, SHA-1, SHA-256 and SHA-512 digests, and verify a checksum.
Text to hash
Digests
Digests appear here as you type.
Verify a checksum
Paste a checksum published alongside a download and it will be compared against every digest above.
About this hash generator
A hash function turns any input into a fixed-length fingerprint. The same input always produces the same digest, and changing a single byte changes the output completely. That makes hashes useful for checking that a file arrived intact, for deduplicating content, and as the building block of signatures — but not, on their own, for storing passwords.
Everything here is computed in your browser. Nothing you type is uploaded, which matters because people commonly hash things they should not be pasting into someone else's server.
Which algorithm should I use?
SHA-256 for anything new. It is the current general-purpose default, widely supported, and has no known practical weaknesses. SHA-512 is the same design with a longer digest and is often faster on 64-bit hardware.
MD5 and SHA-1 are both broken for security purposes — it is practical to construct two different inputs with the same digest. They are still perfectly fine as non-adversarial checksums, cache keys or content fingerprints, and you will keep meeting them because Git uses SHA-1 and countless download pages still publish MD5 sums. Just never use them where an attacker benefits from a collision.
Hashing is not encryption
Hashes are one-way: there is no "unhash" operation, and any site offering to reverse one is really just looking the digest up in a table of pre-computed common inputs. That is exactly why raw hashes are unsuitable for passwords — an unsalted MD5 or SHA-256 of a common password is found instantly. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2.
Verifying a download
Paste the checksum published next to a download into the verify box. A match confirms the bytes are identical to what the publisher hashed. Note that this only proves integrity, not authenticity — if an attacker controls the page, they control the published checksum too, which is what signatures rather than bare hashes are for.
Why are the results different from my terminal?
The usual cause is a trailing newline. echo "text" appends one, so echo "abc" | md5sum hashes four bytes, not three. Use echo -n — or printf — to match what this page computes.