How to use the Hash Generator
Type or paste text, or upload a file to hash its exact contents.
All five hashes appear and update as you type.
Click Copy next to the algorithm you need.
To verify a download, compare the hash with the one published by the provider; they must match exactly.
Examples
hello
MD5: 5d41402abc4b2a76b9719d911017c592 SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
What is a hash?
A cryptographic hash function turns any input, a word or a multi-gigabyte file, into a fixed-length fingerprint. The same input always gives the same hash, but changing even one character produces a completely different result, and you cannot work backwards from the hash to the input.
That makes hashes ideal for checking integrity: if the hash of a file you downloaded matches the one the publisher lists, the file has not been corrupted or tampered with.
Which algorithm should I use?
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 128-bit, 32 hex characters | Broken for security; fine for non-security checksums |
| SHA-1 | 160-bit, 40 hex characters | Deprecated; practical collisions exist |
| SHA-256 | 256-bit, 64 hex characters | Secure, the most widely used choice |
| SHA-384 | 384-bit, 96 hex characters | Secure |
| SHA-512 | 512-bit, 128 hex characters | Secure, often faster on 64-bit machines |
Use SHA-256 unless a system specifically asks for something else. MD5 and SHA-1 are included because many older systems and download pages still publish them.
Do not hash passwords with these
MD5 and the SHA family are designed to be fast, which is exactly wrong for storing passwords: attackers can try billions of guesses per second. Password storage needs slow, salted algorithms built for the purpose, such as Argon2, bcrypt or scrypt. Use this tool for checksums, cache keys, deduplication and verifying files, not for securing credentials.
Text encoding and exact matches
Text is hashed as UTF-8 bytes, the standard on the web and in most programming languages. Hashes are extremely sensitive: a trailing space or a Windows line ending (CRLF instead of LF) changes the result completely. If your hash does not match one produced elsewhere, check for invisible whitespace with Remove Extra Spaces, or hash the original file instead of pasted text.
Need to encode rather than fingerprint data? See the Base64 Encoder.
Worked example: verifying a download
A software site lists the SHA-256 checksum of its installer next to the download link.
- Download the installer.
- Upload the file here. Its SHA-256 hash appears in a moment.
- Compare it with the published value. Copying both into a text editor makes it easy to check every character.
- If they match, the file is exactly what the publisher released. If they differ, delete it and download it again from the official source.
Check that the checksum itself comes from the official site over HTTPS. A tampered download page could list a tampered hash.
Other everyday uses
- Detecting duplicate files by comparing their hashes instead of their contents.
- Cache keys and ETags that change whenever content changes.
- Subresource Integrity attributes for scripts and stylesheets, which use SHA-256, SHA-384 or SHA-512 in Base64 form.
- Comparing configuration between environments without exposing the values themselves.
Frequently asked questions
Last reviewed by the WordTools Pro team. How our tools work