Hash Generator
Compute SHA-1, SHA-256, SHA-384 and SHA-512 for text or a file.
Hashing happens in your browser using the built-in crypto API. Files you open are read locally and never uploaded.
A hash is a fixed-length fingerprint of some data. Change one byte anywhere in a file and the fingerprint changes completely, which is what makes it useful for answering a single narrow question: is this the same as that?
More about Hash Generator
That question turns up more often than people expect. A download page publishes a SHA-256 next to the installer so you can tell a corrupted transfer from a complete one. A deployment pipeline compares hashes to decide whether a build actually changed. A subresource integrity attribute in an HTML page pins a script to one exact version, and the browser refuses to run it if the file has been altered.
This tool computes SHA-1, SHA-384, SHA-512 and SHA-256 for whatever you give it — typed text or a file you open — and shows all four at once, in hex and in Base64. Which one you need depends on the instructions you are following, and computing all of them is faster than asking you to guess and re-run.
It also does the comparison for you. Paste the hash you were given into the check field and it will tell you which algorithm it belongs to and whether it matches, which is more reliable than reading sixty-four hex characters off two screens. Colons, spaces and a `sha256:` prefix are all accepted, because that is how hashes actually arrive.
Everything happens in this page. `crypto.subtle` is a browser API, so a file you open is read into memory here and hashed here; it is never uploaded, which also means a large file is limited by your device rather than by an upload.
- SHA-1, SHA-256, SHA-384 and SHA-512 computed together, no picking first
- Hex and Base64 for every digest, each one ready to copy
- Hash a file by opening it — the bytes never leave your device
- A check field that says which algorithm matched, not just yes or no
- Accepts hashes with colons, spaces, a prefix or any capitalisation
- Each algorithm labelled with whether it is still fit for security use
How to use it
- 1Type or paste your text, or switch to the file tab and open a file.
- 2Read the four digests. Switch between hex and Base64 with the buttons above them.
- 3Copy the one the instructions you are following asked for.
- 4To verify something, paste the hash you were given into the check field.
- 5Read the answer: it names the algorithm when it matches, and says plainly when it does not.
Questions
Why is MD5 not here?
Browsers do not implement MD5, so offering it would mean shipping a third-party copy of an algorithm that has been broken for collisions since 2004. Use SHA-256 unless something you cannot change requires MD5.
Is SHA-1 safe to use?
Not for signatures or certificates: producing two files with the same SHA-1 has been demonstrated and is now cheap. It is still fine as a plain checksum against accidental corruption, which is why git and many download pages still print it.
Is hashing the same as encryption?
No: encryption is reversible with the key, while hashing is one-way by design and there is nothing to reverse it with. A hash cannot be turned back into the file it came from.
Why do two tools give me different hashes for the same text?
Almost always a trailing newline or a different line ending: hashing is over bytes, so an invisible extra character changes everything. Compare the byte counts before assuming one of the tools is wrong.
When would I want the Base64 form?
Subresource integrity attributes and several package manifests use Base64 rather than hex. It is the same digest in a shorter encoding, so pick whichever the thing you are filling in expects.