Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes — for text or files.
100% in your browser — files never leave your device
Text
Hashes appear as you type.
File
How hashing works here
SHA-1 through SHA-512 run through the browser's native Web Crypto API. MD5 doesn't — Web Crypto deliberately omits it because it's considered broken — so this tool ships a small pure-JavaScript MD5 implementation (RFC 1321) alongside it. Both paths run entirely on-device; nothing is sent anywhere.
MD5 and SHA-1 are not collision-resistant: an attacker with enough compute can construct two different inputs that hash identically. Neither should be used anywhere an adversary controls the input — password storage, digital signatures, code-signing verification. They're still fine for what most people actually use them for: catching accidental corruption, not detecting deliberate tampering.
The "Compare to expected hash" field is built for the common real use case — verifying a downloaded file against the checksum a project publishes on its release page. Paste the expected hash, drop the file, and the tool tells you immediately whether any of the five algorithms match.
Frequently asked questions
Are MD5 and SHA-1 safe to use?
Not for security purposes. MD5 and SHA-1 are not collision-resistant — attackers can craft two different inputs that produce the same hash. They are fine for checksums and data integrity checks where there is no adversarial input, but you should use SHA-256 or higher for anything security-sensitive.
Is my text or file uploaded anywhere?
No. All hashing runs entirely in your browser using the Web Crypto API and a local MD5 implementation. No data leaves your device.
What is the file checksum feature for?
Paste the expected hash from a download page into the "Compare to" field and drop your file. The tool tells you whether the hashes match, so you can confirm the file has not been corrupted or tampered with.