A software download page lists a SHA-256 checksum, an API asks for the MD5 of a request body, or you just want to know whether two large files are identical without opening them. All of these come down to computing a hash. This generator calculates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 side by side, for typed text or for a file, and tells you whether a checksum you paste matches any of them.
Hashing runs locally: the SHA family uses the Web Crypto API built into your browser and MD5 uses a small JavaScript library. Files are read from your disk into the tab and never sent over the network.
What a hash function does
A cryptographic hash function turns input of any length into a fixed-length fingerprint, shown here in hexadecimal. The same input always gives the same hash, and changing a single bit produces a completely different one. The word hello has the SHA-256 hash 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, while hello followed by a newline, which is what echo hello sends to a terminal tool, gives 5891b5b5... instead. Hashing is one-way: there is no key and no way to compute the input back from the output.
The algorithms differ in output size and in how well they resist attacks. MD5 (128 bits, 32 hex characters) has had practical collision attacks since 2004, and SHA-1 (160 bits, 40 characters) was publicly broken by the SHAttered collision in 2017. Both are fine for spotting accidental corruption but must not be used for digital signatures, certificates or any setting where an attacker could craft a second file with the same hash. SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family and have no known practical collisions; SHA-256 is the usual choice today.
Practical uses
Verifying a download
Linux distributions, password managers and developer tools publish SHA-256 checksums next to their installers. Hash the file you downloaded, paste the published value into the comparison box, and a Match confirms the file arrived intact and matches what the publisher listed.
Comparing large files quickly
Two backups, two exports or two copies of a video are identical if their SHA-256 hashes are identical. Hashing each file is far more reliable than comparing sizes and dates.
Building and debugging integrations
Cache keys, ETags, content-addressed storage and some APIs rely on hashes of a payload. Computing the expected value by hand lets you see whether a mismatch comes from your code, from a trailing newline or from a different text encoding.
How hashing works on this page
Text is encoded as UTF-8 before hashing, the usual choice in modern code and terminals, so your result should match sha256sum or hashlib for the same bytes. The five hashes update a moment after you stop typing. Because an empty input is still valid input, you will see the well-known hashes of the empty string, such as d41d8cd98f00b204e9800998ecf8427e for MD5, before you type anything.
For files, MD5 is computed in 4 MB chunks with a progress bar, then the SHA hashes are computed from the whole file at once, because the browser's Web Crypto digest function does not stream; for that reason they are only computed for files up to 512 MB, and larger files up to 1 GB get MD5 alone. The comparison box ignores letter case, spaces, a leading label such as SHA256: and a file name after the hash, so a whole line of sha256sum output works, and guesses the algorithm from the length of what you paste: 32 hex characters is MD5, 64 is SHA-256, 128 is SHA-512.
Cara memakai alat ini
- Choose Text or File under Input.
- Type or paste your text, or press Choose a file and pick the file to hash.
- Read the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 values in the Hashes panel and copy any of them with its copy button.
- To verify a checksum, paste it into Compare with an expected hash. The status line reports Match with the algorithm name, or No match.
Limitations
- Files larger than 1 GB are refused, and files larger than 512 MB get only an MD5 hash. Because the SHA hashes need the whole file in memory, files of a few hundred megabytes can still fail on phones or low-memory devices.
- Only MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are offered. SHA-3, BLAKE2/3, CRC32 and keyed HMAC are not available.
- Text is always hashed as UTF-8, so a hash made from text saved as UTF-16 or Windows-1252 will differ; hash the file itself instead.