Hash Generator: MD5, SHA-1, SHA-256, SHA-384 and SHA-512

What is a hash?

A hash function turns any input, from a single letter to a multi-gigabyte file, into a fixed-length string of characters called a hash, digest or checksum. The same input always gives the same hash, and even a tiny change in the input produces a completely different hash. It is also practically impossible to work backwards from a hash to the original input, which is why a hash is called a one-way function.

Because of these properties, hashes are used to check that a file was downloaded correctly, to detect changes, to identify data, and as a building block in digital signatures. This tool calculates five of the most common ones at once.

How to generate a hash

1. Type or paste text into the box, or choose a file to get its checksum.
2. Read the five hashes, which update as you type.
3. Tick Uppercase hex if you need capital letters.
4. To verify a download, paste the checksum from the publisher into the compare box. A green message confirms a match.
5. Copy any hash with its Copy button.

Which algorithm should you use?

• SHA-256: the best general choice today. It gives a 256-bit hash and is widely used for file checksums and in security protocols.
• SHA-512 and SHA-384: longer variants of the same family, used when a longer digest is wanted.
• SHA-1: deprecated for security, because collisions can be created. Keep it for compatibility, such as old Git objects.
• MD5: fast and common for quick checksums and cache keys, but broken for security because collisions are easy to create. Never use it to protect anything.

Verifying a download with a checksum

Software publishers often list a SHA-256 checksum next to a download. After downloading, choose the file here, then paste the published checksum into the compare box. If the values match, the file arrived intact and is the same as the one that was published. If they differ, the download is damaged or has been changed, and you should download it again from the official source.

Hashing is not encryption, and not for passwords

A hash cannot be decrypted, but short or common inputs can be guessed by hashing many candidates and comparing. That is why plain MD5 or SHA-256 is a poor way to store passwords. Websites should use a slow, salted password hashing function such as bcrypt, scrypt or Argon2. Use this tool for checksums and comparisons, not for password storage.

Why a tiny change changes the whole hash

A good hash function has the avalanche property: change one letter in the input and about half the bits of the output flip, so the new hash looks completely unrelated to the old one. Hashing the text abc and then abd gives two totally different strings. This is what makes a hash such a reliable fingerprint. It is also why you can hash a huge file and still compare the result by eye in a few seconds.

A checksum proves integrity, not trust

A matching checksum shows that your file is identical to the one the checksum was made from. It does not prove the file is safe. If an attacker replaced both the download and the checksum on a hacked website, they would still match. For software that matters, take the checksum from a different, trusted channel, or use a publisher's digital signature.

Hash algorithms compared (hash of the text abc)

Frequently Asked Questions