Hash Generator

A hash function turns input of any length into a fixed-length fingerprint called a digest. The same input always produces the same digest, and changing even a single byte produces a completely different one. That makes hashes ideal for checking that a download was not corrupted or tampered with, detecting duplicate files, building cache keys and signing data.

MD5 (128-bit) and SHA-1 (160-bit) are fast and still widely published as checksums, but both are broken for security purposes: practical collision attacks exist, so they must not be used for signatures or certificates. SHA-224, SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family and are the current standard for integrity checks, TLS, code signing and blockchains.

To verify a file checksum, open the File tab, drop the file, and paste the checksum published by the vendor into the Compare field. The tool tells you which algorithm matches, comparing hex case-insensitively and also accepting Base64 digests such as those used in Subresource Integrity attributes.

Plain hashes are not suitable for storing passwords because they are designed to be fast, which helps attackers guess at billions of attempts per second. Use a slow, salted algorithm such as bcrypt (try the bcrypt generator), scrypt or Argon2 instead, and use the HMAC generator when you need to authenticate a message or webhook with a secret key. All hashing here runs locally using the Web Crypto API, SparkMD5 and js-sha256 (for SHA-224); no data is uploaded.