Hash Generator and Checksum Checker
Text & Dev ToolsMD5 and SHA checksums of text or a file, and a match check against the published one — nothing uploaded.
What you type never leaves this device. Everything here runs in your browser — your text is never uploaded, stored or seen by us. Open your network tab and check.
Hashed as UTF-8, like sha256sum and every server library.
Optional. Case, spaces and colons are ignored.
Hashing…
How this is calculated
A hash turns any input into a fixed-length fingerprint. MD5 128 bits 32 hex characters broken for security SHA-1 160 bits 40 hex characters broken for security SHA-256 256 bits 64 hex characters SHA-384 384 bits 96 hex characters SHA-512 512 bits 128 hex characters Same input → same hash, always. Change one byte → a completely different hash. Text is hashed as UTF-8 bytes.
How it works
A hash function reads every byte of its input and produces a short, fixed-length fingerprint. The same input always gives the same hash, and changing a single byte — one letter, one line break — gives a completely different one. That makes a hash the standard way to check that a downloaded file arrived intact: the publisher lists its SHA-256, you compute the SHA-256 of what you downloaded, and if the two match, the file is the one they published.
Text has to become bytes before it can be hashed, and this page uses UTF-8, the same as sha256sum on the command line, Python's hashlib and server libraries, so the results agree. The most common reason a hash does not match is an invisible difference in the input: a trailing line break, a space, or Windows line endings. On the command line, echo adds a line break, so echo hello | sha256sum is the hash of "hello" plus a newline, not of "hello".
MD5 and SHA-1 are broken as security tools. Researchers can deliberately create two different files with the same MD5 or SHA-1 hash, so a matching MD5 does not prove a file was not tampered with by someone who wanted it to match. Both still catch accidental corruption, and many older downloads still publish them, so they are shown — marked. For anything security-related, use SHA-256 or longer.
Hashing is not encryption and not a way to store passwords. A hash cannot be reversed, but fast hashes like these can be guessed at billions of attempts a second, so short or common passwords fall quickly. Password storage needs a deliberately slow function such as Argon2 or bcrypt.
Worked example
The word hello, with and without a line break at the end
- SHA-256("hello")
- 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
- SHA-256("hello" + line break) — what echo hello | sha256sum hashes
- 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03
- One invisible character, a completely different hash.
If a hash does not match, check the input for line breaks and spaces first
How to use it
- Choose Text to hash something you type or paste, or A file to hash a file on your device.
- Read all five checksums at once.
- To verify a download, paste the checksum the publisher lists. The matching line turns green; the page also says which algorithm the pasted checksum's length points to.
- Copy any hash with its button.
What this tool does not do
- Files are read into memory whole, so files over 2 GB are refused, and very large files can make the tab slow while they hash.
- MD5 and SHA-1 are not collision-resistant. A match proves a file was not corrupted by accident, not that it was not deliberately altered.
- Text is hashed as UTF-8 exactly as typed. It does not strip trailing line breaks or convert Windows line endings, which change the hash.
- These are fast, unsalted hashes. They are not suitable for storing passwords.
- No HMAC, SHA-3, BLAKE or CRC checksums.
Frequently asked questions
How do I check a download's checksum?
Choose A file, pick the downloaded file, and paste the checksum from the download page into the compare box. If one of the lines turns green, the file matches. If none does, the download may be incomplete or corrupted, or the checksum may be for a different version of the file.
Why doesn't my hash match the one from the command line?
Usually an invisible difference in the input. echo adds a line break, so echo hello | sha256sum hashes "hello" followed by a newline — 5891b5b5… — while hashing just "hello" gives 2cf24dba…. Windows line endings, trailing spaces and a different text encoding cause the same thing. This page hashes exactly what is in the box, as UTF-8.
Is MD5 still safe to use?
For spotting accidental corruption, yes. For security, no: two different files can be deliberately made to have the same MD5, and the same is true of SHA-1. Use SHA-256 or longer whenever someone might be trying to fool the check.
Can a hash be reversed to get the original text back?
Not directly — the function throws information away. But fast hashes can be guessed: someone can hash millions of likely inputs a second and look for a match, which is why common passwords are found almost instantly. That is also why hashes like these must not be used to store passwords.
Which algorithm should I choose?
Whichever the other side uses — a checksum is only useful compared with one made the same way. When you get to choose, SHA-256 is the standard: widely supported, and not broken. The page shows all five so you do not have to know in advance.
Is my file or text uploaded to be hashed?
No. The hashing runs in your browser, and no network request carries your file or text. The only requests the page makes once you use it are small ones recording that the tool was used.
Related tools
tell us
Last updated 13 September 2026.