Skip to content
koducathome

Hash Generator

Compute SHA-256, SHA-384, SHA-512, SHA-1 and MD5 hashes of text in your browser, with hex or Base64 output.

How to use this tool

Steps for using the Hash Generator.

  1. Type or paste text into the input. It is hashed as UTF-8 and the results update as you type.
  2. Read the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests side by side, and copy any one or all of them.
  3. Choose Hex (lowercase), Hex (uppercase) or Base64 output depending on where the hash will be used.
  4. To checksum a file, click Hash a file and pick a file up to 50 MB; it is read locally with File.arrayBuffer().
  5. Enable HMAC mode and enter a key to compute HMAC-SHA-256, HMAC-SHA-384 and HMAC-SHA-512 instead.
  6. Paste a published checksum into Compare to see whether it matches one of the computed digests.

Example

Hashes of the text "abc"

Text (UTF-8)
abc
Hex digests
MD5: 900150983cd24fb0d6963f7d28e17f72
SHA-1: a9993e364706816aba3e25717850c26c9cd0d89d
SHA-256: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
SHA-384: cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7
SHA-512: ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f

Common use cases

  • Verifying a downloaded file against the SHA-256 checksum published on the release page.
  • Generating a content hash for cache keys, ETags or deduplication.
  • Checking that two configuration files or payloads are byte-for-byte identical.
  • Computing an HMAC-SHA-256 to debug webhook signature verification (e.g. comparing against a signature header).
  • Producing MD5 or SHA-1 values required by older APIs and storage systems.

Hash functions, their limits and what they are for

A cryptographic hash function maps input of any size to a fixed-size digest: 128 bits for MD5, 160 for SHA-1, and 256, 384 or 512 bits for the SHA-2 family. The same input always gives the same digest, and changing a single bit of input changes roughly half of the output bits. That makes hashes ideal for checking that a download, backup or cache entry has not changed. SHA-1 and SHA-2 are computed with the browser's Web Crypto API (crypto.subtle.digest); Web Crypto intentionally omits MD5, so MD5 is implemented here in TypeScript following RFC 1321.

Text is converted to bytes as UTF-8 before hashing, which is what nearly every language and command-line tool does — echo -n 'abc' | sha256sum gives the same SHA-256 as above. Watch out for invisible differences: a trailing newline (plain echo adds one), Windows CRLF line endings or a byte-order mark all produce completely different digests.

MD5 and SHA-1 are broken for collision resistance. Researchers can create two different inputs with the same MD5 hash in seconds, and a practical SHA-1 collision was published in 2017. Neither should be used for signatures, certificates or any case where an attacker could choose the input. They remain acceptable as non-adversarial checksums and for compatibility with legacy systems. Prefer SHA-256 or SHA-512 for anything new.

Hashes are not encryption — there is no key and nothing to decrypt — and none of these plain hashes is suitable for storing passwords. They are designed to be fast, so an attacker with a GPU can test billions of guesses per second against a leaked hash. Store passwords with a slow, salted password-hashing function such as Argon2id, bcrypt, scrypt or PBKDF2. To authenticate a message with a shared key, use HMAC (available in HMAC mode) rather than hashing the key and message together.

Limitations

  • Files are limited to 50 MB and are loaded fully into memory; use sha256sum or shasum -a 256 for larger files.
  • Text is always encoded as UTF-8; other encodings such as UTF-16 or Latin-1 are not offered.
  • HMAC mode supports SHA-256, SHA-384 and SHA-512 with a UTF-8 key; binary (hex or Base64) keys are not supported.
  • SHA-3, BLAKE2/3, CRC32 and password-hashing algorithms are not included.
  • Web Crypto requires a secure context (HTTPS or localhost).

Frequently asked questions

Can I use SHA-256 to store passwords?

No. Plain SHA-256 is far too fast — even with a salt, leaked hashes can be brute-forced at enormous speed. Use Argon2id, bcrypt, scrypt or PBKDF2 with a per-user salt, via your framework's password-hashing API.

Can a hash be reversed or decrypted?

No. Hashing is one-way and there is no key. Short or common inputs can, however, be found by guessing or with precomputed tables, which is why hashes of passwords, phone numbers or emails are not anonymous.

Why does my command-line hash differ from this one?

The bytes differ. echo adds a trailing newline unless you use echo -n or printf, files may have CRLF line endings, and some editors add a byte-order mark. Hashing the file directly with Hash a file avoids text-conversion differences.

Is MD5 still safe for checksums?

For detecting accidental corruption, yes. For anything where an attacker could supply the file — software downloads, signatures, certificates — no, because MD5 collisions are easy to create. Use SHA-256.

Are my files uploaded?

No. Files are read and hashed in your browser with File.arrayBuffer() and the Web Crypto API. Nothing is sent to a server.