Ttooleras
🔐

Hash Generator

Generators

Generate MD5, SHA-1, SHA-256, SHA-512 hashes for text and files. Free, private — all processing in your browser.

Advertisement

A hash is a fixed-length fingerprint of some data: feed in a word or a 2 GB file and you get back a short hex string that changes completely if even one byte of the input changes. This tool computes SHA-1, SHA-256, SHA-384, and SHA-512 for text you type or a file you pick, and has a compare box so you can paste an expected checksum and instantly see which algorithm (if any) matches.

It runs entirely in your browser using the Web Crypto API, so hashing a file never uploads it. One honest note up front: there's no MD5 here — the browser's crypto engine doesn't provide it, and for anything new you shouldn't be using MD5 anyway.

Hash Generator — key features

7+ hash algorithms

Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA-3 (224, 256, 384, 512) hashes from any input. Select one or compute all at once.

Text and file hashing

Type or paste text to hash, or drag and drop any file — images, documents, archives, binaries — to get its checksum.

Hex or Base64 output

Get the hash as hex digits (the default) or Base64 (for compact storage or direct use in HTTP headers like Integrity).

Compare hashes

Paste an expected hash and the tool tells you if it matches — useful for verifying downloaded files against official checksums.

Bulk hashing

Hash multiple strings at once, one per line. Each gets its own hash in the output.

Web Crypto API backend

Uses native browser cryptography (crypto.subtle.digest), the same code that powers HTTPS. Fast, secure, and audited.

Handles large files

Stream files in chunks instead of loading everything at once. Multi-gigabyte files hash without crashing your tab.

100% client-side, private

Hashing happens in your browser. No uploads, no logging. Safe for sensitive files and confidential content.

Step by step

  1. 1

    Choose text or file mode

    Select Text tab to hash a string, or File tab to hash an uploaded file.

  2. 2

    Paste your input

    Type or paste the string, or drag and drop a file from your computer.

  3. 3

    Select algorithm(s)

    Pick MD5, SHA-1, SHA-256, or others. You can compute all at once to compare.

  4. 4

    Choose output format

    Hex (default) for readability and compatibility, Base64 for compact storage in HTTP headers or JSON.

  5. 5

    Copy the result

    The hash appears instantly. Click Copy to put it on your clipboard or Download to save as a file.

  6. 6

    Compare against expected hash (optional)

    Paste a known hash (e.g., from a software publisher's signature page) and the tool confirms match or mismatch.

Common use cases for the Hash Generator

File integrity

  • →Verify downloaded software: Linux distros, open-source projects, and vendor sites publish SHA-256 checksums for their downloads. Hash the file after downloading and compare to detect corrupted or tampered files.
  • →Detect file changes: Store hashes of important files and periodically re-hash to detect unauthorized modifications (e.g., Tripwire, AIDE).
  • →Deduplicate storage: If two files have the same SHA-256 hash, they are the same file — use this to avoid storing duplicates in cloud storage systems.
  • →Bit-rot detection: Hash archival files on write, re-hash periodically. Mismatches indicate silent disk corruption.

Content fingerprinting and caching

  • →Cache keys: Use a hash of the input as a cache key — same input produces same key, no need for complex lookup logic.
  • →Content-addressable storage: Git, IPFS, and Docker all identify objects by content hash. Same content → same ID.
  • →Asset URLs with hashes: Web build tools (Webpack, Vite) append file content hashes to asset names so caches invalidate automatically when files change.
  • →ETags for HTTP caching: Send the SHA-256 hash of a response as the ETag header. Clients send If-None-Match on subsequent requests; the server can return 304 Not Modified.

Security applications

  • →Password hashing (with bcrypt/argon2): Never use plain SHA for passwords — use bcrypt, argon2, or scrypt. These are hash functions designed to be slow to resist brute force.
  • →Digital signatures: RSA, ECDSA, Ed25519 sign a hash of the message, not the message itself. SHA-256 or SHA-384 is typical.
  • →HMAC authentication: Combine SHA-256 with a secret key for message authentication codes (webhook signatures, API auth). Use our [HMAC Generator](https://tooleras.com/tools/hmac-generator).
  • →Certificate fingerprints: SSL/TLS certificates are identified by SHA-256 or SHA-1 fingerprints. Verify certificate authenticity by comparing fingerprints.

Blockchain and Bitcoin

  • →Bitcoin mining: Bitcoin uses double SHA-256 for block hashing. Miners compute billions of hashes per second looking for one below the target.
  • →Blockchain addresses: Bitcoin addresses are derived from SHA-256 + RIPEMD-160 of the public key. Ethereum uses Keccak-256.
  • →NFT content identification: NFTs reference media by content hash (IPFS) so the asset cannot be silently swapped.

Hash Generator in practice

MD5 of short text

Fast, 32-character output. Good for non-security checksums.

Input
Hello, World!
Output
MD5: 65a8e27d8879283831b664bd8b7f0ad4

SHA-256 of a sentence

The default modern hash — 64 characters of hex.

Input
The quick brown fox jumps over the lazy dog
Output
SHA-256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

SHA-512 (longer hash)

128 hex characters — for high-security applications.

Input
password123
Output
SHA-512: ba3253876aed6bc22d4a6ff53d8406c6ad864195ed144ab5c87621b6c233b548baeae6956df346ec8c17f5ea10f35ee3cbc514797ed7ddd3145464e2a0bab413

Empty string hashes

Known sentinel values — every hash function produces a specific output for empty input.

Input
(empty string)
Output
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA-1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

File checksum verification

Verify downloaded file integrity.

Input
Downloaded ubuntu-24.04-live-server-amd64.iso
Hash the file with SHA-256
Expected: e240e4b801f7bb68c20d1356b60968ad0c33a41d00d828e74ceb3364a0317be9
Output
Computed hash matches expected — file is genuine

SHA-256 in Base64

Compact Base64 encoding (44 chars instead of 64 hex).

Input
Hash: SHA-256 of "Tooleras"
Format: Base64
Output
SHA-256: tXn2pR8vK9/d2Z+QGq3mEQXnBw4nzKlpoXZAgJ5DXdI=

Technical details

What a hash function does. It maps any input to a fixed-size output, one-way: you can't run it backwards to recover the input, and a tiny change to the input scrambles the entire output (the "avalanche" effect). SHA-256 always returns 64 hex characters, SHA-512 returns 128, regardless of input size.

Which algorithm to use.
- SHA-256 — the sensible default for integrity checks and general use.
- SHA-512 / SHA-384 — larger digests; SHA-512 is often *faster* on 64-bit CPUs and fine when you want extra margin.
- SHA-1 — still here because a lot of existing systems (git object IDs, old checksums) use it, but it's cryptographically broken: researchers can craft two different files with the same SHA-1. Use it only to match legacy values, never for new security decisions.

The most important caveat: hashing is not encryption and not password storage. A hash can't be reversed, but identical input always yields identical output — so a plain SHA of a password is quickly cracked with lookup tables. Passwords need a slow, salted algorithm like bcrypt (see the Bcrypt Generator), not SHA.

Common problems and solutions

⚠Hashing passwords with SHA-256

SHA is fast, so attackers can try billions of guesses per second against a stolen hash. Passwords need a slow, salted algorithm — bcrypt, scrypt, or Argon2 — not a general-purpose hash.

⚠Trusting SHA-1 (or MD5) for security

Both have practical collision attacks. They're fine for detecting accidental corruption or matching legacy values, but never for signatures, deduplication of untrusted files, or anything an attacker could exploit.

⚠Expecting to reverse a hash

Hashing is one-way; there is no unhash. So-called reverse lookups just try known inputs against precomputed tables — they only work for common values, which is exactly why unsalted password hashes fall.

⚠Checksum mismatch that looks alarming

A single changed byte flips the whole hash, so a mismatch often just means an incomplete or corrupted download — re-download and re-check before assuming tampering. Also make sure you're comparing the same algorithm.

⚠Comparing hashes with different casing or whitespace

Hex hashes are case-insensitive but stray spaces or newlines break a string comparison. The compare box here normalizes case; trim any copied whitespace.

Hash Generator — comparisons and alternatives

SHA-256 vs SHA-1 vs MD5. MD5 and SHA-1 are both broken for security — collisions are demonstrable — and survive only for legacy compatibility and non-adversarial checksums. SHA-256 is the modern baseline. If you're choosing today, choose SHA-256 (or SHA-512).

Hashing vs encryption. Encryption is two-way (encrypt, then decrypt with a key). Hashing is one-way by design — there's no "unhash." Use hashing to *verify* data, encryption to *protect* it.

Hashing vs HMAC. A plain hash proves data wasn't accidentally corrupted. An HMAC (hash + secret key) proves it came from someone who holds the key — that's what you want for signing API requests and webhooks. See the HMAC Generator.

Hashing vs password hashing. General hashes (SHA) are built to be *fast*, which is exactly wrong for passwords. Password hashing (bcrypt, scrypt, Argon2) is deliberately *slow* and salted to resist cracking. Never store passwords with SHA.

Frequently asked questions about the Hash Generator

▶Is my file uploaded when I hash it?

No. Files are read and hashed in your browser with the Web Crypto API. Nothing leaves your device, so it's safe to hash private or large files.

▶Why is there no MD5 option?

The browser's native crypto engine doesn't provide MD5, and it shouldn't be used for anything new — it's been broken for years. For legacy MD5 checksums you'll need a dedicated tool; for everything else, SHA-256 is the right call.

▶Is SHA-1 safe to use?

Only for legacy compatibility (matching an old checksum, git object IDs) and non-security checks. It has practical collision attacks, so never use it for signatures or anything an attacker could exploit. Prefer SHA-256.

▶Can I get the original text back from a hash?

No — hashing is one-way by design. Tools that appear to reverse a hash are just looking up common inputs in a precomputed table; they can't recover arbitrary data.

▶How do I verify a downloaded file?

Hash the downloaded file here, then paste the checksum the publisher provided into the compare box. If it matches the same algorithm, the file is intact. A mismatch usually means a corrupted or incomplete download.

▶Can I use this to hash passwords?

No. SHA is far too fast for password storage. Use bcrypt (or scrypt/Argon2), which is deliberately slow and salted — see our Bcrypt Generator.

Useful references

Advertisement

Related tools

All Generators
🔄

Base64 Encoder/Decoder

Encode and decode Base64 strings, files, and images instantly

🔒

Bcrypt Hash Generator

Hash passwords with bcrypt and verify existing hashes — configurable rounds

🔏

HMAC Generator

Generate HMAC signatures (SHA-256, SHA-512) for API auth and webhook verification

🎫

JWT Decoder

Decode and inspect JSON Web Token (JWT) headers, payloads, and signatures

🎫

JWT Generator

Create signed JSON Web Tokens (JWT) with custom claims — HS256, RS256, ES256

🔑

Password Generator

Generate strong, cryptographically secure random passwords

Learn more

How to Decode a JWT: A Practical Debugging Guide (with the Base64URL Gotcha Nobody Warns You About)

17 min read

UUID v4 vs v7: The Default Has Quietly Changed

22 min read

MD5, SHA-1, SHA-256: Three Kinds of Hashing Everyone Confuses

24 min read

Explore more tools

200+ free tools that run in your browser.

Browse all tools →