Hash Generator
Generate SHA-256, SHA-512, SHA-1 and MD5 hashes of text or files, and check downloads against a published checksum.
| Algorithm | Digest |
|---|
File checksum
Any size, several at once · read in this tab, never uploaded
Guide & FAQWhat a hash function does · Which algorithm to use · Never hash passwords with these · Verifying a download · When the browser calls a download suspicious · Collisions and preimages · Frequently asked questions
What a hash function does
A cryptographic hash turns any input, of any size, into a fixed-length fingerprint. The same input always produces the same digest; changing a single bit produces a completely different one; and there is no practical way to run the process backwards. That combination makes hashes useful for verifying integrity, deduplicating data and storing password verifiers.
Which algorithm to use
| Algorithm | Digest size | Status |
|---|---|---|
| MD5 | 128 bits | Broken. Collisions can be produced in seconds. Non-security checksums only. |
| SHA-1 | 160 bits | Broken. A practical collision was demonstrated in 2017; browsers and certificate authorities rejected it years ago. |
| SHA-256 | 256 bits | Recommended. The current default for signatures, certificates and file integrity. |
| SHA-384 / SHA-512 | 384 / 512 bits | Also fine, and often faster than SHA-256 on 64-bit hardware. |
| CRC32 | 32 bits | Not cryptographic at all — an error-detection checksum for archives and network frames. |
Never hash passwords with these
SHA-256 is designed to be fast, which is exactly wrong for passwords: a modern GPU computes billions of SHA-256 hashes per second. Password storage needs a deliberately slow, salted, memory-hard function — Argon2id, scrypt or bcrypt. Use a maintained library and never write your own scheme.
Verifying a download
Projects publish a SHA-256 digest next to their release files, either on the release page or as a SHA256SUMS file with one line per file. Drop the downloads in above and paste that file as it is: each line is matched to a file by name, and a file whose name is not in the list is still matched by its hash, so a renamed download is found too. Both the GNU layout (hash filename) and the BSD layout (SHA256 (filename) = hash) are read, as are uppercase hex, hex split by spaces or colons, a sha256: prefix and Base64 digests such as subresource-integrity values. The algorithm is picked from the length of each hash.
A mismatch means the file is corrupt, incomplete or not the file the project published. Note that a checksum hosted on the same page as the download only protects against corruption — for tamper protection you need a signature from a key you already trust.
Large files are read in 8 MB pieces, so a 5 GB disk image does not have to fit in memory. SHA-256, MD5 and CRC32 are computed for files of any size; SHA-1, SHA-384 and SHA-512 use the browser's built-in hashing, which needs the whole file at once, so they are skipped for files over 512 MB.
When the browser calls a download suspicious
Chrome and Edge warn about a file as "uncommon" or "suspicious" largely on reputation: how many other people have downloaded that exact file and whether it is signed by a publisher the browser knows. A new release of a small open-source tool trips that warning for its first days simply because few people have it yet, and the warning does not say so.
A checksum answers a narrower question the warning does not: is this the exact file the project published? Take the hash from the project's own release page or repository rather than from the site you downloaded from, and check the file here. A match rules out a corrupted download or a substituted file from a mirror; it does not tell you the project itself is trustworthy.
Collisions and preimages
A collision is two different inputs with the same digest; a preimage is finding an input that produces a given digest. Collision resistance is the weaker property and is what falls first — MD5 and SHA-1 are collision-broken but not preimage-broken, which is why old md5sum checks still catch accidental corruption even though they cannot stop a determined attacker.
Frequently asked questions
Is my file uploaded to compute the hash?
No. The file is read and hashed in your browser. You can disconnect from the network and the tool still works.
How do I check a file against a SHA256SUMS file?
Drop the downloaded files in, then paste the whole contents of the SHA256SUMS file into the checksum box. Each file is matched to its line by name and marked as a match or a mismatch; lines for files you did not download are ignored.
Chrome says my download is suspicious. Does a matching checksum make it safe?
A match proves the file is byte-for-byte the one whose hash you compared against, so take the hash from the project itself. It rules out corruption and a swapped file, but not a problem in the original — the warning is mostly about how rarely the file has been downloaded.
Can a hash be reversed?
Not by computation. Short or common inputs can be found by brute force or in a rainbow table, which is why password hashing needs a unique salt and a deliberately slow algorithm.
Why is MD5 still everywhere if it is broken?
MD5 is fast and short, and for detecting accidental corruption it works fine. The break matters when an attacker can choose the input — then two different files can be crafted with the same MD5.
Why does the same file give a different hash on another site?
Almost always a different algorithm, or a text input with different line endings. A file that ends \r\n on Windows hashes differently from the same file with Unix line endings.
What is the difference between hex and Base64 output?
Both encode the same bytes. Hex is twice the digest length and easy to read; Base64 is about a third shorter and is what HTTP headers such as Content-Digest and subresource integrity attributes use.