Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hash digests from text or files.
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hash digests from text or files. 100% private in browser.
Hash Algorithms
How do I use Hash Generator?
Switch between 'Text Input' or 'File Checksum' mode and paste text, drop a file, or click 'Sample'.
Optionally toggle 'UPPERCASE HEX' to format digests for Windows/BIOS checksum comparisons.
Copy the simultaneously computed MD5 (128-bit), SHA-1 (160-bit), SHA-256 (256-bit), or SHA-512 (512-bit) hex digest.
What features does Hash Generator offer?
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes simultaneously
Support for both text strings and direct file checksum hashing
100% client-side Web Crypto API execution
1-click copy hash digests to clipboard
Cryptographic Hash Functions (RFC 1321 & NIST FIPS 180-4)
SHA-1, SHA-256, and SHA-512 are computed via the browser's hardware-accelerated Web Crypto API (`crypto.subtle.digest`), while MD5 uses a synchronous client-side RFC 1321 implementation.
| Algorithm | Bit Length | Hex Length | Collision Resistance & Security Status (2026) |
|---|---|---|---|
| MD5 (RFC 1321) | 128 bits | 32 hex chars | Broken for security; use only for non-adversarial file checksums |
| SHA-1 (FIPS 180-4) | 160 bits | 40 hex chars | Deprecated (SHAttered collision); legacy Git object IDs only |
| SHA-256 (SHA-2) | 256 bits | 64 hex chars | Cryptographically secure; standard for TLS, Docker, and SRI |
| SHA-512 (SHA-2) | 512 bits | 128 hex chars | Cryptographically secure; faster than SHA-256 on 64-bit CPUs |
Frequently Asked Questions about Hash Generator
Why does hashing a text file on Windows produce a different SHA-256 hash than on Linux?
Cryptographic hashes exhibits the avalanche effect: a single byte difference changes ~50% of the output bits. Windows saves line breaks as 2 bytes (`CRLF` / `0x0D 0x0A`), whereas Linux saves 1 byte (`LF` / `0x0A`).
Why should I never use raw SHA-256 or MD5 to hash user passwords?
General-purpose digests like MD5 and SHA-256 are designed to run as fast as possible on GPUs (billions of hashes per second), making them vulnerable to rainbow tables and brute-force attacks. Always use a slow, salted key-stretching algorithm like Bcrypt (`/tools/bcrypt-generator`) or Argon2id for passwords.
Can I verify the SHA-256 checksum of a large `.iso` or `.zip` file without uploading it?
Yes. In 'File Checksum' mode, your file is read directly from disk into an `ArrayBuffer` and hashed inside your browser's `crypto.subtle.digest` engine with zero network uploads.
Can a SHA-256 or MD5 hash be decrypted back into the original text?
No. Cryptographic hash functions are one-way mathematical compression functions that discard information while mapping arbitrary-length inputs into a fixed-size bit array.
Explore Related Developer Tools
HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
Stripe Webhook Signature Verifier
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.
Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.
JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, signature, and expiration status.
Shopify Webhook HMAC Verifier (Base64)
Compute and verify Base64-encoded X-Shopify-Hmac-Sha256 webhook signatures for Shopify orders/create and GDPR webhooks in browser.
GitHub Webhook Signature Tester
Compute and verify GitHub X-Hub-Signature-256 (sha256=<hex>) HMAC-SHA256 webhook headers for push and pull_request events.