This tool computes common cryptographic hash functions — MD5, SHA-1, SHA-256, SHA-384, and SHA-512
— from any text you type, updating live as you type. SHA hashes are computed using your browser's
native, audited Web Crypto API; MD5 (which browsers don't expose natively) is computed with a compact,
spec-verified JavaScript implementation.
What hashing is good for
Data integrity checks: Confirm a downloaded file or transmitted payload wasn't corrupted, by comparing hashes.
Deduplication: Detect identical content (e.g. duplicate log lines or documents) by comparing hashes instead of full text.
Cache busting & content addressing: Use a content hash as part of a cache key or filename so it changes only when the content changes.
Quick fingerprints in debugging: Compare two large payloads for equality without diffing them line by line.
Do not use MD5 or SHA-1 for security-sensitive purposes such as storing passwords or
signing data. Both are cryptographically broken for collision resistance. For password storage, use a
purpose-built algorithm like bcrypt, scrypt, or Argon2, which are designed to be slow and salted.
SHA-256/384/512 remain suitable for integrity checks and digital signatures, but even they are not
appropriate for hashing passwords directly.
How to actually verify a downloaded file
A publisher posts something like SHA-256: 9f86d081884c7d659a2f... next to a download link.
After downloading, hash the file (most operating systems have a built-in command, or paste text content
here) and compare the result character by character against the published value. An exact match means
the file arrived intact and matches what the publisher actually posted; any difference, even a single
character, means the file was corrupted in transit or isn't what it claims to be.
Want to understand what's happening under the hood?
See How Hashing Works for a plain-language explanation of what
makes a hash function one-way, why collisions matter, and specifically why fast algorithms like these are
the wrong choice for passwords even though they're perfectly fine for the checksum use cases above.
Frequently Asked Questions
No. None of the algorithms here (MD5 or the SHA family) are designed for password storage — they're fast, which makes them easy to brute-force. Use bcrypt, scrypt, or Argon2 in your backend instead.
MD5 is still widely used for non-security purposes like checksums, deduplication, and legacy file-integrity checks, so it's included for compatibility — just not for anything where an attacker could benefit from creating a collision.
Yes — SHA-1, SHA-256, SHA-384, and SHA-512 are computed using the Web Crypto API built into your browser, the same standards-based implementation used by production web applications.
No. All hashing, including MD5, happens locally in your browser.
Each algorithm is designed to produce a fixed output size regardless of input: MD5 always outputs 128 bits (32 hex characters), SHA-1 outputs 160 bits (40 hex characters), and SHA-256 outputs 256 bits (64 hex characters). The longer output size is part of why SHA-256 is harder to attack.
Yes, always — that's a defining property of a hash function. The same exact input, byte for byte, will produce the identical hash every time, on any device, which is exactly what makes hash comparison a reliable way to check whether two pieces of content match.