Hash generator

What a hash is for

A hash turns any amount of data into a short fixed-length fingerprint. The same input always gives the same fingerprint, and changing a single bit changes it completely. That makes it useful for one thing above all: checking that a file you downloaded is byte-for-byte the file that was published.

Nothing is uploaded

The file is read and hashed by your own browser. That matters more here than on most tools: the entire purpose of verifying a download is defeated if you have to send the file to a stranger first. You can watch the network panel while you use it, or disconnect after the page loads.

Which one to use

• SHA-256 — the default answer. Use it unless something else is demanded.
• SHA-512 — no weaker, and faster than SHA-256 on 64-bit machines.
• SHA-1 — broken for signatures since 2017. Still seen in Git object ids and older systems.
• MD5 — broken. Offered because vendors still print MD5 next to downloads, and matching one is still worth doing.

What a matching MD5 does and does not prove

It proves the file has not been corrupted in transit. It does not prove nobody tampered with it. Chosen-prefix collisions against MD5 are practical, so an attacker who controls both files can make two different files share an MD5. If you are checking authenticity rather than integrity, use SHA-256 and get the expected value from a source you trust.

Example

The MD5 of the text abc is 900150983cd24fb0d6963f7d28e17f72, and its SHA-256 is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Both are published test vectors, so you can check this tool against them.

Limitations

SHA hashing uses the browser's built-in cryptography, which is only available on a secure connection. Very large files are limited by available memory rather than by any quota here.

Related tools

See the HMAC generator for keyed authentication, and the Base64 encoder.