Hash Generator — SHA-256, SHA-1 and SHA-512 Hash Online

SHA-1, SHA-256, SHA-384 and SHA-512 from the browser's Web Crypto API, plus MD5 for legacy checksums. The digest is shown as a lowercase hexadecimal string, which is the format expected by checksum files, package manifests and HMAC tooling.

They differ in output length and design generation. SHA-256 is the modern default for integrity checks and most blockchain use. SHA-384 and SHA-512 produce longer digests that resist length-extension attacks. SHA-1 is shown for legacy compatibility but is no longer considered safe against collision attacks.

No — both are broken against deliberate collision attacks, so never use them for passwords, signatures or any security-sensitive work. They are included here purely for legacy compatibility: verifying old download checksums, ETags and existing manifests. For anything new, use SHA-256 or longer; for non-security uses like cache keys, SHA-256 truncated to the size you need works well.

Both. Paste a string or drop a file into the input box — the tool reads the file as a binary stream and feeds it directly to the hashing API, so the digest matches the one produced by sha256sum, openssl dgst or PowerShell's Get-FileHash.

No. Cryptographic hashes are one-way functions: given a digest, there is no efficient way to recover the input. That is the entire point — integrity checks, password storage and signatures all rely on this property.

No. The Web Crypto API runs the hash inside your browser, so the input never crosses the network. That makes the tool safe for secrets, private keys and any file you would not want to upload.

Yes. Switch the Source toggle to Text to hash a pasted string, or to File to drop in any file. Either way the tool computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once and lets you copy any of them, so a file digest matches what sha256sum or PowerShell's Get-FileHash would produce.

Each algorithm row (MD5, SHA-1, SHA-256, SHA-384, SHA-512) has its own Copy button next to the hex digest. The large primary button at the bottom is a shortcut for SHA-256 specifically since it's the most commonly requested value, but every other digest can be copied individually the same way.

Yes — MD5 is shown alongside SHA-1, SHA-256, SHA-384 and SHA-512 even though the browser's built-in Web Crypto API doesn't implement MD5. The tool includes its own pure-JavaScript MD5 implementation specifically so you can match checksums against old downloads, ETags and manifests that still publish MD5 — it's included for legacy compatibility, never for anything security-sensitive.

Click Clear at any time to wipe the pasted text or dropped file — the previous digests disappear immediately so you're never comparing a stale hash by accident. You can also just switch the Source toggle between Text and File; each source keeps its own input independently.

Switch the Source toggle to File, drop the download (installer, ISO, archive) into the tool, and compare the SHA-256 row against the checksum published on the publisher's site — use the one-click Copy SHA-256 button to paste it straight into a comparison instead of retyping the long hex string. Because hashing runs locally via Web Crypto, the file itself never leaves your device during the check.

No — this tool computes fixed digests: MD5, SHA-1, SHA-256, SHA-384 and SHA-512. Bcrypt, scrypt and Argon2 are deliberately slow, salted algorithms designed for storing login passwords, and they belong in your backend code, not in a converter. You can still hash any text here with SHA-256 for checksums or cache keys, but never store user passwords as plain unsalted digests.

A hash value is a fixed-length fingerprint computed from your input: SHA-256 always yields 64 hex characters whether you hash one word or a 2 GB file. The same input always produces the same value, while a one-byte change produces a completely different one — which is exactly what makes a hash value generator useful for integrity checks and duplicate detection.

No — Hash Generator runs entirely in your browser, so what you paste never leaves the machine you are on. That matters if you are checking something that contains a token, a key or customer data. Closing the tab is enough to clear it.

The error points at the first position that could not be parsed, which is usually just after the real mistake rather than on it — a missing comma, an unclosed quote or bracket, or a smart quote pasted in from a document instead of a straight one. Check the line above the reported position first.

Hash Generator shows its result on the page. Standard use does not require signup; this workflow does not offer a file download. Published processing allowances and file limits still apply.

No — Hash Generator runs in the browser on desktop and phone. There is nothing to install, no trial to start, and no license to buy before you can see whether it does what you need. Try it on the file you are actually stuck with rather than a sample.

The hash covers every byte, so a trailing line break, different line endings or another text encoding changes it. Commands that print a value often add a final newline, which is part of what gets hashed. Hash the exact bytes the other tool used, or hash the file itself instead of pasted text.

Files up to 64 MB are hashed, and larger ones are refused with a message. Pasted text is limited to 2,000,000 characters. The whole file is read into memory first, so for bigger files such as disk images, use a command-line tool on your computer instead.

It means the file is identical to whatever the checksum was computed from. If the checksum came from the same compromised page, the match proves little, and a hash cannot tell you whether a file contains malware. Take the expected value from a separate, trusted channel such as the publisher's signed announcement.

Hashing runs in your browser. While you are signed in, a hashed file is also uploaded and saved privately to My Work with a checksum report, within your storage allowance, and copying a digest from pasted text saves a report of the digests there too. Signed out, files stay on your device. For a sensitive file, hash it while signed out.