Multi Hash Generator

How to use 3 steps

Enter Text, or choose a file.
Pick the Output format and paste a known hash to compare, if you have one.
Press Hash text or Hash file, then Copy all.

Text

…or a file The file is read in your browser and never uploaded.

Output

Compare with a known hash Optional

Hashes

SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser’s own Web Crypto implementation; MD5 is computed here, because Web Crypto deliberately does not offer it. Text is hashed as UTF-8, which is what command-line tools such as sha256sum use, so the values match. MD5 and SHA-1 are both broken for security purposes and are included only for checksums and legacy compatibility — do not use them to store passwords or verify signatures.

How this tool works

A hash function turns an input of any size into a fixed-length string. The same input always gives the same hash, one changed byte gives a completely different one, and the process cannot be reversed. That combination is useful for one thing above all: proving two pieces of data are identical without comparing them directly.

The everyday use is verifying a download. Hash the file, paste the published checksum into the comparison box, and a match means the file is byte-for-byte what the publisher released. Hashing runs entirely in your browser, so neither text nor file is uploaded, which matters when you are hashing something confidential to verify it rather than to share it.

Picking an algorithm, and two things hashes are not for

Use SHA-256 unless told otherwise: MD5 and SHA-1 are cryptographically broken. They remain fine as checksums against accidental corruption, and wrong wherever someone might forge a match deliberately.
Line endings change the result: the same text saved with Windows CRLF hashes differently from Unix LF. If a hash will not match and the content looks identical, check that first.
Hashing is not encryption: encryption is reversible with a key; hashing is not reversible at all. If you need the original data back, you need encryption.
Never store passwords with it: the speed of these functions is exactly what lets an attacker try billions of guesses. Password storage needs bcrypt, scrypt or Argon2.

What a hash is, and what it is for

A hash function takes input of any size and produces a fixed-length string of hexadecimal characters. The same input always produces the same hash; changing a single byte produces a completely different one. Hashes cannot be reversed to recover the original input.

That combination makes them useful for one thing above all: proving that two pieces of data are identical without comparing them directly. Download a Linux ISO, hash it, compare against the checksum the project published, and you know whether the file arrived intact and unmodified. That is the everyday use, and it is what the comparison field in the [msm_tool slug="multi-hash-generator"] is for.

Which algorithm should you use?

Algorithm	Output	Status
MD5	32 hex characters	Broken. Non-security use only.
SHA-1	40 hex characters	Broken. Deprecated since 2017.
SHA-256	64 hex characters	Secure. The general-purpose default.
SHA-384	96 hex characters	Secure.
SHA-512	128 hex characters	Secure. Often faster than SHA-256 on 64-bit systems.

If you are choosing and have no specific requirement, use SHA-256.

Why MD5 and SHA-1 are still offered

Both are cryptographically broken, meaning it is practical to construct two different inputs that produce the same hash — a collision. For MD5 this has been demonstrable on ordinary hardware for years. For SHA-1, Google and CWI Amsterdam published the first practical collision in 2017, and the attack has become substantially cheaper since.

A collision matters when a hash is being used as proof of authenticity, because an attacker can craft a malicious file that matches the hash of a legitimate one. It does not matter when the hash is being used as a non-adversarial checksum — detecting accidental corruption, deduplicating files, generating cache keys, or bucketing records. That is why both algorithms remain in wide use and why the [msm_tool slug="multi-hash-generator"] still offers them.

The rule is simple. If an attacker would benefit from producing a matching hash, do not use MD5 or SHA-1. If the only thing you are defending against is a corrupted download or a duplicate row, either is fine.

Hashing text and hashing files

The tool handles both. Type or paste text and hash it directly, or select a file and hash its contents. The file path is used for the checksum comparison; hashing a downloaded ISO, installer or archive and pasting the publisher's checksum into the comparison field will confirm a match or tell you plainly that it does not.

One thing that catches people out when hashing text: trailing whitespace and line endings change the result. A file saved with Windows CRLF line endings hashes differently from the same text saved with Unix LF endings, even though it looks identical on screen. If a hash does not match and the content appears the same, line endings are the first thing to check.

Everything runs in your browser. Neither the text nor the file is uploaded, which matters when you are hashing something confidential to verify it rather than to share it.

What hashes are not for

Two common misuses are worth naming.

Hashing is not encryption. Encryption is reversible with a key; hashing is not reversible at all. If you need to recover the original data later, you need encryption, not a hash.

Plain SHA-256 is not how to store passwords. Fast hash functions are exactly the wrong tool, because their speed is what lets an attacker test billions of guesses per second against a stolen database. Password storage requires a deliberately slow, salted algorithm designed for the purpose — bcrypt, scrypt or Argon2. Using SHA-256 for passwords is a well-known and serious mistake.

Frequently Asked Questions

Specific to the Multi Hash Generator. Broader questions about this category are answered on the category page.

Can a hash be reversed or decrypted?

No. Hashing discards information, so the original input cannot be reconstructed. What sites advertising "MD5 decryption" actually do is look the hash up in a precomputed table of common inputs — which works for short or common strings and fails entirely for anything unpredictable.

Why do two files with the same name have different hashes?

Because their contents differ, even if only by a byte of metadata, a trailing newline or a difference in line endings. Hashes describe content, not filenames.

How do I verify a downloaded file?

Select the file above, generate its hash using the algorithm the publisher specifies, and paste their published checksum into the comparison field. A match means the file is byte-for-byte identical to the one they published. A mismatch means it is not — corrupted in transit, incomplete, or tampered with.

Is MD5 safe to use?

For checksums against accidental corruption, yes. For anything where someone might deliberately try to forge a match, no. Use SHA-256 in that case.

Are my files uploaded to generate the hash?

No. Hashing runs entirely in your browser. Files are read locally and never transmitted.

Why might the SHA algorithms be unavailable?

The SHA family uses the browser's built-in Web Crypto API, which browsers restrict to secure contexts — pages served over HTTPS, or localhost. On an insecure connection those algorithms are not exposed to the page. The tool checks for this and tells you rather than failing silently. MD5 is implemented directly and works regardless.