Is my file uploaded for hashing?

No. The browser reads the file into the memory of the page and calculates every value there; nothing is sent to a server. If this page shows ads, the ad script runs in the same page, but the tool never passes your data to it.

Is MD5 still safe to use?

For detecting a damaged download, an MD5 value that the publisher printed still works. For anything an attacker could influence, such as signatures or deduplication of uploaded files, it is not: MD5 collisions can be produced in seconds on an ordinary computer. Use SHA-256 or SHA-3 there. Passwords need a slow password hash such as Argon2id, scrypt, bcrypt or PBKDF2, not any of the functions on this page.

How do I verify a SHA-256 checksum on Windows?

Run Get-FileHash file.iso -Algorithm SHA256 in PowerShell, or certutil -hashfile file.iso SHA256 in a command prompt, and compare the result with the published value. Or choose the file here and paste the published value into “Expected hash”.

Can I get the original text back from a digest?

No. A hash function cannot be reversed; the digest does not contain the data. Short or common inputs can still be found by trying candidates, which is why a digest of a password or a phone number is not anonymous.

What is the difference between SHA-256 and SHA3-256?

Both give 256-bit digests, but they are different algorithms: SHA-256 belongs to SHA-2, SHA3-256 to the Keccak-based SHA-3 family. The same input gives unrelated values, so a checksum must be checked with the algorithm that produced it.

The tool says Web Crypto is not available. What can I do?

Browsers offer this interface only on pages loaded over a secure connection (HTTPS). Open the page with https at the start of the address.

MD5 and SHA Hash Generator

Hash a text or a file with ten algorithms and compare it with a published checksum.

Runs in your browser. Your input is not sent anywhere.

Text to hash

Hashed exactly as written, including spaces and line breaks.

Input format of the text

Or hash a file

The file is read in this browser tab and is not uploaded. Up to 256 MB.

Output format

Expected hash (optional)

Paste a published checksum to compare it with the result.

Remember my input on this device

Off by default. When on, the fields of this tool are kept in the local storage of this browser, unencrypted, until you turn it off.

Nothing hashed yet

Your result will appear here.

Keyboard shortcuts

Ctrl + Enter, ⌘ + Enter: Run the tool with the current input
Alt + Shift + C: Copy the result
Alt + Shift + X: Clear all fields

Shortcuts work while the focus is inside the tool. Every action is also available as a button.

What this tool does

A hash function turns data of any length into a short value of fixed length, the digest. The same data always gives the same digest, and changing a single bit changes the digest completely, so a digest works as a fingerprint of a file or a text.

The tool calculates ten values at once: MD5, SHA-1, the SHA-2 functions SHA-256, SHA-384 and SHA-512, the SHA-3 functions SHA3-224, SHA3-256, SHA3-384 and SHA3-512, and the CRC32 checksum. If you paste the checksum that a publisher printed next to a download, it tells you which of them matches.

How to use it

Type or paste a text, or choose a file of up to 256 MB.
For text, choose how it is read: as UTF-8 text, as hexadecimal bytes such as 61 62 63, or as Base64.
Choose the output format: hexadecimal in lower or upper case, or Base64.
To verify a download, paste the published checksum into “Expected hash (optional)”. Spaces, colons and the case of hexadecimal letters do not matter.
Read the digests and the result of the comparison, and copy them if you need them.

Text is hashed exactly as it stands in the field. A space or a line break at the end changes the digest. Line breaks in the field are single line feeds (LF); to hash a file with Windows line endings (CRLF), choose the file instead of pasting its text.

Worked example

The three letters abc are the standard example of RFC 1321 (MD5), FIPS 180 (SHA-1 and SHA-2) and FIPS 202 (SHA-3). Without a line break at the end they give these values:

Digests of the text abc

MD5       900150983cd24fb0d6963f7d28e17f72
SHA-1     a9993e364706816aba3e25717850c26c9cd0d89d
SHA-256   ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
SHA3-256  3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532
CRC32     352441c2

The same values come out when you choose “Hexadecimal bytes” and enter 616263, or “Base64 bytes” and enter YWJj, because all three describe the same three bytes. The usual reason for a different result on a command line is the line break that echo adds: printf abc | sha256sum gives the value above, echo abc | sha256sum hashes four bytes.

How the values are calculated

SHA-1 and the SHA-2 functions come from the Web Crypto interface of your browser (SubtleCrypto.digest). Web Crypto has no MD5, SHA-3 or CRC32, so the page contains its own code for these three: MD5 as RFC 1321 specifies it, SHA-3 as the Keccak sponge of FIPS 202, and CRC32 with the polynomial of zip, gzip and PNG (CRC-32/ISO-HDLC, check value cbf43926). The code is tested against the published test values and against independent implementations for inputs of many lengths.

The whole file is read into memory on your device, which is the reason for the size limit. MD5, SHA-3 and CRC32 are then computed in pieces of 1 MB, so that the page stays responsive and shows how far it has got.

The expected hash is compared with every digest of the same length. SHA-256 and SHA3-256 are both 64 hexadecimal digits long; the result names the one that matches.

The same values on the command line

Commands for a file named file.iso

# Linux
md5sum file.iso
sha256sum file.iso
openssl dgst -sha3-256 file.iso

# macOS
shasum -a 256 file.iso

# Windows (PowerShell, then cmd)
Get-FileHash file.iso -Algorithm SHA256
certutil -hashfile file.iso SHA256

# CRC32 as zip and gzip compute it
python3 -c "import sys, zlib; print(format(zlib.crc32(open(sys.argv[1], 'rb').read()), '08x'))" file.iso

The cksum command of POSIX systems prints a different CRC (CRC-32/CKSUM, which also covers the length), so its number does not match CRC32.

Reference: the algorithms in this tool

Length of the values
Algorithm	Bits	Hexadecimal digits	Base64 characters
MD5	128	32	24
SHA-1	160	40	28
SHA3-224	224	56	40
SHA-256, SHA3-256	256	64	44
SHA-384, SHA3-384	384	96	64
SHA-512, SHA3-512	512	128	88
CRC32	32	8	8

SHA-2 and SHA-3 are the current standards. SHA-3 is not a newer version of SHA-2 but a different design, standardized in 2015 as an alternative; both are considered secure.

MD5 and SHA-1 are broken for security purposes: collisions, two inputs with the same digest, can be made on purpose. RFC 6151 advises against MD5 where collision resistance matters, and NIST plans to phase out SHA-1 by December 31, 2030. Both remain in the tool because many existing checksums use them.

CRC32 is not a cryptographic hash at all. It detects accidental damage such as a flipped bit, but anyone can change data and keep its CRC.

Common mistakes

Hashing a text with an extra line break at the end, or with Windows line endings instead of Unix line endings.
Pasting hexadecimal or Base64 while “Text (UTF-8)” is selected. The tool then hashes the characters, not the bytes they describe.
Taking a matching checksum as proof of origin. A checksum from the same page as the download protects against damaged files, not against someone who could replace both.
Using MD5, SHA-1 or CRC32 where an attacker could choose the data, for example to sign or deduplicate files that strangers upload.
Comparing a cksum result with CRC32; they are different checksums.

Sources

Frequently asked questions

Is my file uploaded for hashing?: No. The browser reads the file into the memory of the page and calculates every value there; nothing is sent to a server. If this page shows ads, the ad script runs in the same page, but the tool never passes your data to it.
Is MD5 still safe to use?: For detecting a damaged download, an MD5 value that the publisher printed still works. For anything an attacker could influence, such as signatures or deduplication of uploaded files, it is not: MD5 collisions can be produced in seconds on an ordinary computer. Use SHA-256 or SHA-3 there. Passwords need a slow password hash such as Argon2id, scrypt, bcrypt or PBKDF2, not any of the functions on this page.
How do I verify a SHA-256 checksum on Windows?: Run Get-FileHash file.iso -Algorithm SHA256 in PowerShell, or certutil -hashfile file.iso SHA256 in a command prompt, and compare the result with the published value. Or choose the file here and paste the published value into “Expected hash”.
Can I get the original text back from a digest?: No. A hash function cannot be reversed; the digest does not contain the data. Short or common inputs can still be found by trying candidates, which is why a digest of a password or a phone number is not anonymous.
What is the difference between SHA-256 and SHA3-256?: Both give 256-bit digests, but they are different algorithms: SHA-256 belongs to SHA-2, SHA3-256 to the Keccak-based SHA-3 family. The same input gives unrelated values, so a checksum must be checked with the algorithm that produced it.
The tool says Web Crypto is not available. What can I do?: Browsers offer this interface only on pages loaded over a secure connection (HTTPS). Open the page with https at the start of the address.

Last updated: September 29, 2026