Hash Generator

A hash function takes any input — a word, a paragraph or a whole file — and produces a fixed-length “fingerprint” of it, written as hexadecimal. The same input always gives the same hash, but the tiniest change to the input produces a completely different one. Hashes are one-way: you cannot work backwards from the fingerprint to the original data. They are used to verify downloads (checksums), store passwords safely, deduplicate files and check that data has not been tampered with in transit.

They differ in output size and cryptographic strength. MD5 produces a 128-bit (32-character) hash and SHA-1 a 160-bit one; both are fast but broken for security use, as researchers can deliberately create collisions. The SHA-2 family — SHA-256, SHA-384 and SHA-512 — produces longer hashes (256, 384 and 512 bits) and has no known practical collision attacks, so it is the right choice for anything security-related. This tool shows all of them side by side so you can pick the one a system expects.

Not for security. Both have practical collision attacks, meaning an attacker can craft two different inputs with the same hash, so they must never be used for signatures, certificates or password storage. They are still perfectly fine for non-adversarial jobs like a quick file checksum, cache keys or detecting accidental corruption. When security matters, use SHA-256 or stronger — and for passwords specifically, use a dedicated password hash such as bcrypt or Argon2 rather than a plain SHA.

No. Hashing is a one-way operation — the output contains no recoverable copy of the input, and many inputs map to each hash, so there is nothing to “decode”. Sites that claim to reverse a hash are really just looking the value up in a precomputed table of common inputs (a rainbow table); they only work for weak, unsalted hashes of guessable values. This tool only generates hashes; it does not and cannot reverse them.

No. SHA-1, SHA-256, SHA-384 and SHA-512 are computed with the browser’s built-in Web Crypto API, and MD5 runs in a small piece of JavaScript on the page. Files are read locally with the File API and never leave your device — you can confirm this by watching your browser’s network panel while you hash a file. The share link carries only your text input in the URL fragment, which is never sent to a server.

Switch to File mode and drop in the downloaded file, then paste the checksum the publisher provided into the “Compare with” box. The tool computes every hash locally and highlights the row that matches, so you can confirm at a glance that the SHA-256 (or MD5) of your copy is identical to the official one. A match means the file downloaded intact and has not been altered; no match means you should download it again from a trusted source.