Hash Generator
Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes from text or a file. Computed in your browser — nothing is uploaded.
About Hash Generator
Hash Generator produces a fixed-length fingerprint of any text or file using the SHA family of algorithms. The same input always yields the same hash, and changing a single byte changes the output completely — which is what makes hashes useful for verifying that data arrived intact.
The everyday use is checking a download. A project publishes the SHA-256 of its installer; you hash the file you actually received and compare. If the two strings match, your copy is byte-for-byte identical to the one that was published, which rules out both a corrupted transfer and a tampered mirror. If they differ by even one character, something is wrong and the file should not be run.
Hashes are one-way by design. There is no operation that turns a hash back into the original input, which is why they are used to store passwords: a server can check whether you typed the right password without ever holding the password itself. That property is also why a hash is not a substitute for encryption — you cannot recover what you hashed, so it is useless for anything you need to read back.
Algorithm choice comes down to what the hash is for. SHA-256 is the sensible default and is what most projects publish. SHA-512 is longer and can be marginally faster on 64-bit hardware. SHA-1 remains widely encountered — Git uses it, and older systems still publish it — but practical collision attacks have been demonstrated against it, so it should be treated as a compatibility option rather than a security one.
How to generate a hash
- Choose Text to hash something you type, or File to hash a document or download.
- Enter your text, or drop the file in.
- Pick an algorithm — SHA-256 is the right default.
- Generate the hash.
- Compare it against the published checksum, character for character.
Tips & common problems
Compare the whole string
Attackers count on people checking only the first and last few characters. Paste both values somewhere and compare them in full, or use your browser's find function.
Whitespace changes everything
A trailing newline or space produces a completely different hash. If a text hash does not match what you expected, check for invisible characters at the end.
MD5 is not offered here
The Web Crypto API does not implement it, and MD5 has been broken for collision resistance since 2004. Where a project still publishes only an MD5, treat it as a corruption check, not a security guarantee.
Large files take a moment
The whole file is read into memory and hashed locally, so a multi-gigabyte file depends on your device's available memory rather than on any upload speed.
Frequently asked questions
Is my file uploaded to check its hash?
No. The file is read and hashed entirely in your browser using the Web Crypto API. It never leaves your device, which is what makes this safe for sensitive documents.
Which algorithm should I use?
SHA-256 unless you have a specific reason otherwise. It is the standard choice for verifying downloads and is what most projects publish alongside their releases.
Can a hash be reversed to get the original data?
No. Hashing is one-way by design. So-called reverse lookup sites simply have large tables of pre-computed hashes for common inputs; they are not reversing anything.
Why does my hash not match the one on the website?
Usually the download is incomplete or corrupted, or you are comparing against a different algorithm than the one published. Confirm you are using the same algorithm, then re-download and hash again.
Why is MD5 missing?
The browser's cryptography API does not provide it, and MD5 is no longer considered safe against deliberate collisions. Adding a third-party implementation for a broken algorithm was not a worthwhile trade-off.
Is SHA-1 safe to use?
Not for security purposes — practical collision attacks exist. It is included because many existing systems and repositories still use it, so you may need it for compatibility.