Hash Generator — SHA-256, SHA-1 & SHA-512

Generate a secure hash (checksum) of any text or file, and verify a download really matches the hash the publisher listed. Uses your browser’s built-in Web Crypto engine — nothing is uploaded.

Or hash a file — drop it here or click to choose

Verify an ISO, installer or backup against its published checksum

Hashing: text input

How to Generate a Hash

  1. Type or paste your text — all four hashes appear instantly as you type.
  2. To check a download, drop the file into the file box instead. Large files are read in chunks.
  3. Press Copy next to whichever algorithm you need.
  4. To verify a download, paste the publisher’s checksum into the Verify box. A green banner means it matches exactly.

What Is a Hash?

A hash is a fixed-length fingerprint of some data. Feed in a single letter or a 4 GB video and you always get the same size output — 64 hex characters for SHA-256, for example. Hashing is one-way: you cannot turn a hash back into the original data, which is exactly why it is used for passwords and integrity checks.

Change a single byte of the input and the hash changes completely. That is what makes it useful for spotting corrupted or tampered files.

Verifying a Download (Checksum Check)

When a project publishes an SHA-256 checksum next to a download link, it is so you can confirm the file arrived intact and was not swapped out. Drop the downloaded file above, paste the published checksum into the verify box, and look for the green match. If it does not match, do not run the file — re-download it from the official source.

Which Algorithm Should I Use?

  • SHA-256 — the modern default. Use this unless you have a reason not to.
  • SHA-512 — longer output, and often faster than SHA-256 on 64-bit machines.
  • SHA-384 — a truncated SHA-512, used in some TLS and certificate settings.
  • SHA-1 — broken for security purposes since practical collisions were demonstrated in 2017. Only use it to match legacy systems such as older Git object IDs, never for new security work.
Why is MD5 not offered? MD5 has been cryptographically broken for years and browsers deliberately leave it out of the Web Crypto standard. Any tool offering MD5 in the browser is shipping its own implementation. For integrity checking, SHA-256 is the right answer.

Frequently Asked Questions

Can a hash be reversed back into the original text?

No. Hashing is a one-way function. Short or common inputs can sometimes be guessed by brute force against a lookup table, which is why passwords should always be hashed with a salt and a slow algorithm such as bcrypt or Argon2.

Are my files or text uploaded?

No. Hashing runs entirely in your browser through the Web Crypto API, so even confidential files never leave your device.

Why does my hash differ from another tool’s?

Almost always a difference in the input, not the algorithm. A trailing newline, a space, or a different text encoding produces a completely different hash. Hash the file itself rather than its text if you need an exact match.

Is there a file size limit?

Only your device’s memory. Files of several hundred megabytes hash fine; very large files simply take a few seconds.

Related Tools

Password Generator · Base64 Encoder · JSON Formatter

All tools