Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes instantly from any text or file. Hashes update as you type — no button needed. File checksum generation for download verification.

Type or paste text — MD5, SHA-1, SHA-256 and SHA-512 update as you type

Input

Hash Results

MD5128-bitLegacy · use for checksums only
—
SHA-1160-bitDeprecated for security use
—
SHA-256256-bit
—
SHA-512512-bit
—

About this tool

A privacy-first hash generator that produces four hash types simultaneously. Switch between text input (with live update as you type) and file upload (for checksum verification of downloads, builds, or backups). All four hashes — MD5, SHA-1, SHA-256, and SHA-512 — appear side-by-side so you can copy exactly what you need.

SHA-1, SHA-256, and SHA-512 use the browser's built-in crypto.subtle Web Crypto API. MD5 is implemented in pure JavaScript (the Web Crypto API does not support MD5 as it is cryptographically broken). Nothing is sent to any server.

How to use

1

Choose Text or File

Use the Text tab to hash any string — API keys, messages, passwords. Use the File tab to generate checksums for downloads, installers, or backups.

2

Enter your input

Type or paste into the textarea (hashes update instantly) or drag-and-drop a file onto the upload zone. Files up to 50 MB are supported.

3

Read the results

All four hash types (MD5, SHA-1, SHA-256, SHA-512) appear immediately. Each is displayed in full in a monospace code box — click it to select all.

4

Copy what you need

Use the copy button next to each hash for individual copying, or Copy All to get all four hashes formatted and ready for a spec sheet or documentation.

Related tools

Base64 Encoder / Decoder

Encode text or files to Base64, or decode Base64 strings back to plain text.

Password Generator

Generate strong, cryptographically random passwords of any length.

UUID Generator

Generate cryptographically random UUID v4 identifiers in bulk.

JSON Formatter

Format and validate JSON — useful for inspecting API responses before hashing.

Frequently asked questions

Common questions about hash functions, checksums, and how to use this tool.

A hash function takes any input (text, file, data) and produces a fixed-length string called a digest or hash. The same input always produces the same hash, but even a tiny change in the input completely changes the output. Hashes are used to verify file integrity (checksums), store passwords securely, detect duplicate files, and sign digital documents.

MD5 produces a 128-bit (32-character hex) hash. It is fast but cryptographically broken — collisions can be engineered, so it should only be used for non-security checksums. SHA-1 produces a 160-bit hash and is also deprecated for security use. SHA-256 and SHA-512 (part of the SHA-2 family) produce 256-bit and 512-bit hashes respectively and are currently considered secure. Use SHA-256 or SHA-512 for all security-sensitive applications.

No. Hash functions are one-way — it is computationally infeasible to reverse a hash back to its input. This is by design. What attackers can do for weak hashes (like MD5/SHA-1) is pre-compute hashes of common inputs and compare (rainbow table attacks). That is why salted hashing or dedicated password-hashing algorithms (bcrypt, Argon2) should be used for passwords.

Switch to the File tab, upload the downloaded file, and copy the SHA-256 (or whichever algorithm the publisher specifies) hash. Compare it character-by-character with the hash published on the software's official download page. If they match exactly, the file is intact and was not tampered with during download.

This is called the avalanche effect — a fundamental property of cryptographic hash functions. Any change to the input, no matter how small, cascades through the algorithm and produces a completely different output. This ensures that hashes cannot be predicted or manipulated incrementally.

This tool is designed for checksums and data integrity — not password storage. For passwords, you should always use a dedicated slow hashing algorithm with salts (bcrypt, Argon2, PBKDF2) on your server, never MD5 or SHA on the client. If you paste a real password here for testing, clear the input field afterwards and treat it as compromised.

No. All hashing runs entirely in your browser using the built-in Web Crypto API (for SHA-1, SHA-256, SHA-512) and a pure-JavaScript MD5 implementation. Your text and files never leave your device. The tool works offline once the page has loaded.