What a hash is, and what it is for
A hash function takes input of any size and produces a fixed-length string of hexadecimal characters. The same input always produces the same hash; changing a single byte produces a completely different one. Hashes cannot be reversed to recover the original input.
That combination makes them useful for one thing above all: proving that two pieces of data are identical without comparing them directly. Download a Linux ISO, hash it, compare against the checksum the project published, and you know whether the file arrived intact and unmodified. That is the everyday use, and it is what the comparison field above is for.
Which algorithm should you use?
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 32 hex characters | Broken. Non-security use only. |
| SHA-1 | 40 hex characters | Broken. Deprecated since 2017. |
| SHA-256 | 64 hex characters | Secure. The general-purpose default. |
| SHA-384 | 96 hex characters | Secure. |
| SHA-512 | 128 hex characters | Secure. Often faster than SHA-256 on 64-bit systems. |
If you are choosing and have no specific requirement, use SHA-256.
Why MD5 and SHA-1 are still here
Both are cryptographically broken, meaning it is practical to construct two different inputs that produce the same hash — a collision. For MD5 this has been demonstrable on ordinary hardware for years. For SHA-1, Google and CWI Amsterdam published the first practical collision in 2017, and the attack has become substantially cheaper since.
A collision matters when a hash is being used as proof of authenticity, because an attacker can craft a malicious file that matches the hash of a legitimate one. It does not matter when the hash is being used as a non-adversarial checksum — detecting accidental corruption, deduplicating files, generating cache keys, or bucketing records. That is why both algorithms remain in wide use and why they are offered here.
The rule is simple. If an attacker would benefit from producing a matching hash, do not use MD5 or SHA-1. If the only thing you are defending against is a corrupted download or a duplicate row, either is fine.
Hashing text and hashing files
The tool handles both. Type or paste text and hash it directly, or select a file and hash its contents. The file path is used for the checksum comparison; hashing a downloaded ISO, installer or archive and pasting the publisher's checksum into the comparison field will confirm a match or tell you plainly that it does not.
One thing that catches people out when hashing text: trailing whitespace and line endings change the result. A file saved with Windows CRLF line endings hashes differently from the same text saved with Unix LF endings, even though it looks identical on screen. If a hash does not match and the content appears the same, line endings are the first thing to check.
Everything runs in your browser. Neither the text nor the file is uploaded, which matters when you are hashing something confidential to verify it rather than to share it.
What hashes are not for
Two common misuses are worth naming.
Hashing is not encryption. Encryption is reversible with a key; hashing is not reversible at all. If you need to recover the original data later, you need encryption, not a hash.
Plain SHA-256 is not how to store passwords. Fast hash functions are exactly the wrong tool, because their speed is what lets an attacker test billions of guesses per second against a stolen database. Password storage requires a deliberately slow, salted algorithm designed for the purpose — bcrypt, scrypt or Argon2. Using SHA-256 for passwords is a well-known and serious mistake.
Frequently asked questions
Can a hash be reversed or decrypted?
No. Hashing discards information, so the original input cannot be reconstructed. What sites advertising "MD5 decryption" actually do is look the hash up in a precomputed table of common inputs — which works for short or common strings and fails entirely for anything unpredictable.
Why do two files with the same name have different hashes?
Because their contents differ, even if only by a byte of metadata, a trailing newline or a difference in line endings. Hashes describe content, not filenames.
How do I verify a downloaded file?
Select the file above, generate its hash using the algorithm the publisher specifies, and paste their published checksum into the comparison field. A match means the file is byte-for-byte identical to the one they published. A mismatch means it is not — corrupted in transit, incomplete, or tampered with.
Is MD5 safe to use?
For checksums against accidental corruption, yes. For anything where someone might deliberately try to forge a match, no. Use SHA-256 in that case.
Are my files uploaded to generate the hash?
No. Hashing runs entirely in your browser. Files are read locally and never transmitted.
Why might the SHA algorithms be unavailable?
The SHA family uses the browser's built-in Web Crypto API, which browsers restrict to secure contexts — pages served over HTTPS, or localhost. On an insecure connection those algorithms are not exposed to the page. The tool checks for this and tells you rather than failing silently. MD5 is implemented directly and works regardless.