MD5 & SHA Hash Generator
- No Sign-up
- 100% Free
- Zero Server Data
Type or paste text and all five digests appear together, so you do not have to know which algorithm a checksum used before you can compare it. Text is hashed as UTF-8 bytes, which is what the command-line tools do. MD5 and SHA-1 are included because checksums and older systems still use them, and both are labelled as unfit for passwords or signatures.
| Algorithm | Hash | Actions |
|---|
Which algorithm to use
| Algorithm | Output | Use it for | Safe against a deliberate collision |
|---|---|---|---|
| MD5 | 32 hex characters | Checking a file downloaded intact | No: collisions cost minutes |
| SHA-1 | 40 hex characters | Git object ids, legacy systems | No: broken in practice since 2017 |
| SHA-256 | 64 hex characters | The default choice for anything new | Yes |
| SHA-384 | 96 hex characters | Where a longer digest is mandated | Yes |
| SHA-512 | 128 hex characters | As above; faster than SHA-256 on 64-bit hardware | Yes |
The distinction in the last column is narrower than it sounds. MD5 is fine for catching a truncated download, because a corrupted file is an accident and accidents do not produce colliding digests. It is not fine anywhere an attacker chooses the input, because then the collision is the attack.
One thing none of these are for: storing passwords. They are built to be fast, which is the opposite of what a password hash needs. Use bcrypt, scrypt or Argon2, all of which are deliberately slow.
Checking a download against its published checksum
- Hash the file on your own machine. Nothing needs installing:
shasum -a 256 filenameon macOS or Linux,certutil -hashfile filename SHA256on Windows. - Compare it with the value published beside the download.
- If they differ, the file is not the one that was published. Download it again before assuming the worst. A truncated download is far more common than a tampered one.
Paste both values into the box above if you want them lined up character by character rather than squinting at a terminal.
Worth knowing what this proves: that the file matches what the site published. If the site itself was compromised, the checksum was published by the same attacker. A signature, not a checksum, is what defends against that.
Why the same text can give a different hash
A hash covers bytes, not characters, so anything that changes the bytes changes the digest completely.
- A trailing newline. The usual culprit.
echo "abc"hashes four bytes, not three. Useecho -norprintf. - Encoding. This tool hashes UTF-8, which is what command-line tools use. A system hashing UTF-16 gets a different answer for the same text.
- Invisible characters. A non-breaking space pasted from a web page is not a space, and a carriage return from a Windows file is not nothing.
Frequently asked questions
Why include MD5 if it is broken?
MD5 is broken wherever an attacker gets to choose the input: producing two files with the same MD5 has been cheap for years. It is still the number printed next to a lot of downloads, and checking that number is a reasonable thing to want to do. When the choice is yours, use SHA-256.
Can I hash a file?
No, this box takes text you type or paste. Your operating system can already hash a file without installing anything: shasum -a 256 filename on macOS and Linux, or certutil -hashfile filename SHA256 on Windows.
Why does my terminal give a different hash?
Almost always a trailing newline. echo adds one, so echo "abc" hashes four bytes rather than three. Use echo -n, or printf, when you are comparing against what you typed here.
Is my text uploaded?
No. SHA hashes are computed by your browser’s built-in crypto, MD5 by JavaScript on this page, and the site’s security policy sets connect-src ‘none’, so the browser blocks network requests from these pages.