The standard test vector
- Input
- abc
- Output
- ba7816bf8f01cfea…f20015ad
The published SHA-256 of the string abc. Any correct implementation produces this, which makes it a quick way to confirm a tool is working.
Hash Generator
A hash turns any input into a fixed-length fingerprint, so two files can be compared without transferring either one. This tool uses the browser's own Web Crypto implementation for the SHA family and can hash a file without loading it anywhere but memory. MD5 and SHA-1 are included because real systems still use them, but both are labelled with what they are no longer safe for.
Runs entirely in your browser — nothing you paste is uploaded.
Hashing is not password storage. A password needs a deliberately slow algorithm such as Argon2 or bcrypt, with a salt stored alongside it.
How to
How to use the Hash Generator
- 1
Choose an algorithm
SHA-256 is the sensible default. MD5 and SHA-1 are available for legacy systems and are marked with what they must not be used for.
- 2
Enter text or pick a file
Type or paste text, or select a file to hash its exact bytes. A downloaded ISO or installer can be checked this way without uploading it.
- 3
Read the digest
The hash appears as lowercase hexadecimal. Text input hashes as you type; a file is read once and hashed in one pass.
- 4
Verify against a published checksum
Paste the expected value into the verification field. Comparison ignores case and any filename after the hash, which is how checksums are usually published.
Examples
Hash Generator examples
Non-ASCII text
- Input
- café
- Output
- 07117fe4a1ebd544965dc19573183da2 (MD5)
The text is encoded as UTF-8 before hashing. Libraries that default to Latin-1 produce a completely different digest for the same visible text, which is a common source of mismatches.
Verifying a download
- Input
- ubuntu.iso + published SHA-256
- Output
- Match
The file is read in your browser and never uploaded. Comparison ignores case and trailing filenames, so you can paste a checksum line straight from a release page.
Why use it
What the Hash Generator gives you
The browser's own implementation
SHA hashes come from Web Crypto rather than a hand-written implementation, so they are the same code the browser uses for TLS.
Files never leave your machine
A file is read locally and hashed in memory, which means you can verify a download without sending it anywhere.
Honest about weak algorithms
MD5 and SHA-1 are offered with a plain statement of what broke them and when, rather than being listed as equal options.
Encoding handled correctly
Text is hashed as UTF-8, so accented and non-Latin input produces the digest other correct tools produce.
Good to know
Hash Generator limitations
- Hashing is not encryption and not password storage. A password needs a slow algorithm such as Argon2 or bcrypt, which no browser tool should be doing.
- A hash cannot be reversed, but a short or common input can be found in a lookup table, so hashing alone does not anonymise data.
- Very large files are read into memory, so a multi-gigabyte image may fail in the browser.
- MD5 and SHA-1 are included for compatibility and must not be relied on where an attacker could choose the input.
Summary
Hash Generator in short
- SHA-256 is the right default for anything new.
- MD5 has been broken since 2004 and SHA-1 since 2017; neither is safe against a deliberate collision.
- Files are hashed locally, so a download can be verified without uploading it.
- Text is hashed as UTF-8, which is why digests here match other correct implementations.
- Hashing is not password storage — use a purpose-built slow algorithm for that.
FAQ
Hash Generator questions
Which hash algorithm should I use?
SHA-256 unless something forces your hand. It is fast, widely supported and has no known weakness. SHA-512 is actually quicker on 64-bit hardware if you need a longer digest.
Why is MD5 marked as broken?
Collisions — two different inputs with the same hash — have been producible since 2004 and now take seconds on a laptop. That makes MD5 useless for signatures or tamper detection, though it still works as a non-adversarial checksum or cache key.
Is SHA-1 still safe to use?
Not for anything an attacker can influence. A practical collision was demonstrated in 2017, and browsers stopped trusting SHA-1 certificates soon after. It survives in Git object ids and older systems where the threat model does not include a deliberate collision.
Can I hash passwords with this?
You can, but you should not store the result. Password hashing needs a deliberately slow algorithm with a salt — Argon2, scrypt or bcrypt — because SHA-256 is fast enough to test billions of guesses per second on commodity hardware.
Can a hash be turned back into the original text?
Not by computation — the function discards information. But a short, common or predictable input can be found by hashing candidates until one matches, which is why hashing an email address does not anonymise it.
Is my file uploaded when I hash it?
No. The browser reads the file into memory and hashes the bytes locally. Nothing is transmitted, which is what makes verifying a confidential download here reasonable.
My checksum does not match. What went wrong?
Usually an incomplete download, or the published checksum being for a different version or algorithm. Check you are comparing the same algorithm — a SHA-256 value is 64 hex characters and an MD5 is 32, so the length tells you immediately.
Why does the same text give a different hash elsewhere?
Almost always a character encoding difference. Text has to become bytes before it can be hashed, and a library defaulting to Latin-1 rather than UTF-8 produces a different digest for any non-ASCII input. This tool always uses UTF-8.
What is a salt and does this tool add one?
A salt is random data mixed with the input so identical values do not produce identical hashes. This tool does not add one, because a salt has to be stored alongside the hash by the system that owns it — adding one here would produce a value you could never reproduce.
Discover
Related developer tools
UUID GeneratorGenerate cryptographically random v4 UUIDs or time-sortable v7 UUIDs in bulk, and inspect any UUID's version and variant.Base64 EncoderEncode and decode Base64 in your browser. Handles emoji and accented text correctly, with URL-safe output and clear errors.URL EncoderPercent-encode and decode URLs and query values. Explains when to escape a whole URL and when to escape a single parameter.JSON ViewerFormat, validate and explore JSON in your browser. Reports the line and column of an error and flags numbers too large to survive.