Hash Generator

about this tool

Every digest at once

Paste text or drop a file and you get MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 and CRC32 together, rather than picking one and running it again when the value you were given turns out to be a different length. Output is available as hex or Base64, since checksums are published both ways.

SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser's own crypto implementation. MD5, the SHA-3 family and CRC32 are not available there, so a small WebAssembly module is fetched the first time you need one — which is why this tool is marked as loading a library rather than being pure browser JavaScript.

Checking a file you downloaded

The usual reason to be here: a project publishes a SHA-256 for its installer and you want to know your copy is intact. Drop the file in, paste the published digest into the compare box, and you get a plain match or no-match. Comparison ignores case and surrounding whitespace, so pasting straight out of a release page works, and the algorithm is guessed from the digest's length so you rarely need to choose it.

Large files are read in chunks in the page. Nothing is uploaded, which is the only sane arrangement — uploading a file to verify it defeats the purpose.

Which algorithm to use

SHA-256 for anything new. It is fast, universally supported, and has no known weaknesses.

MD5 and SHA-1 are broken and the tool says so next to each. Both have practical collision attacks: an attacker can construct two different files with the same digest. They are still fine for detecting accidental corruption, and completely unsuitable for signatures, certificates or deduplicating files you do not control.

CRC32 is not a hash at all. It is a checksum designed to catch transmission damage, it is trivial to forge deliberately, and it appears here only because zip archives and some firmware images publish one.

If what you actually need is a strong password rather than a hash of one, the password generator is the right tool.

Hashing is not encryption, and not for passwords

A hash is one-way: there is no decode button because there is nothing to decode. It is also not password storage. A raw SHA-256 of a password can be cracked at billions of guesses a second on a consumer GPU. Password storage needs a slow, salted function built for it — bcrypt, scrypt or Argon2 — and that belongs in your server code, not in a page like this one.

To check an archive you were sent, the zip inspector lists its contents before you extract anything.

questions

Can I reverse a hash to get the original text?

No. Hashing is one-way and there is nothing to decode. Sites that appear to 'decrypt' MD5 are looking values up in a table of precomputed common inputs, which works only for short or predictable text.

Which hash algorithm should I use?

SHA-256 for anything new. MD5 and SHA-1 both have practical collision attacks and are unsuitable for signatures or certificates, though they remain fine for spotting accidental file corruption.

How do I check a downloaded file against a published checksum?

Drop the file in and paste the published digest into the compare box. The algorithm is guessed from the digest's length, and comparison ignores case and stray whitespace, so pasting straight from a release page works.

Is my file uploaded to check its hash?

No. Files are read and hashed in chunks inside your browser. Uploading a file in order to verify it would defeat the purpose of verifying it.

Can I use a hash to store passwords?

Not one of these. A raw SHA-256 of a password can be tested at billions of guesses a second on a consumer GPU. Password storage needs a slow salted function built for the job, such as bcrypt, scrypt or Argon2, running on your server.