🧰 ToolPicoAll Tools →

Hash Generator

Instantly calculate the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digest of any text or file. Compare hashes, verify file integrity, and sign messages with HMAC — all in your browser, with no data ever sent to a server.

5 algorithms at once 🔒 100% in your browser 📁 Text + file Updated: Jul 19, 2026
📁
Drag and drop files here or click to browse — you can select multiple files for batch hashing
Auto-detected by length: 32=MD5, 40=SHA-1, 64=SHA-256, 96=SHA-384, 128=SHA-512 hex characters.
⚠ The link encodes the text you entered into the URL; don't use "Copy link" for sensitive or confidential text.
Quick answer This hash generator instantly computes the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digest of the text you enter or the file you upload. The SHA family is computed with the browser's built-in Web Crypto API, and MD5 with pure JavaScript. You can copy the result and compare it against an expected hash to verify file integrity — no data is ever sent to a server.
5Algorithms (MD5–SHA-512)
2Input types (text/file)
100%Private, in your browser
BatchMulti-file + CSV export
🔒 Privacy: All computation happens inside your browser; the text you enter or the file you upload is never sent to, saved on, or uploaded to any server. SHA-1/256/384/512 is computed with the browser's built-in Web Crypto API (crypto.subtle.digest), and MD5 with our own pure JavaScript implementation — no external library or CDN is used. Only when you click "Copy link" is your text encoded into a shareable address; files are never encoded into a link.
🔐 Hash Generator — ToolPico ↗

What is a hash, and how is it calculated?

A full explanation of MD5 and the SHA family, how file integrity checking works, and which algorithm to use when.

A hash function is a mathematical operation that converts data of any length (text, a file, an image) into a fixed-length string of characters unique to that data. The same data always produces the same hash; changing even a single bit of the data changes the hash completely. This tool computes the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests of the text you enter or the file you upload, all at once.

What is MD5?

Quick answerMD5 is an older hash algorithm that converts data into a 128-bit (32 hex character) digest. It's fast but considered cryptographically weak. Because collision attacks exist, it should not be used for security-critical work (passwords, signatures) — it's best reserved for non-critical work like fast file checksums.

How is SHA-256 calculated?

Quick answerSHA-256 splits data into 512-bit blocks and applies a 64-round compression function to each block, producing a 256-bit (64 hex character) digest. In the browser this is done at hardware speed and securely via crypto.subtle.digest('SHA-256', data); this tool calls that function for you automatically.

How do you check file integrity (checksum)?

Quick answerUpload the file you downloaded to the "File" tab, and paste the hash the publisher provided into the "Expected hash" box. The tool computes the file's actual hash and automatically compares it; a match means the file is intact and unmodified.

This check is especially useful for catching errors from a dropped connection or a corrupted download in large file transfers (software installers, disk images, archives). Publishers usually prefer SHA-256 because it's far more secure than MD5 or SHA-1.

What's the difference between MD5 and SHA?

Quick answerMD5 produces a 128-bit digest, SHA-1 a 160-bit digest, SHA-256 a 256-bit digest, SHA-384 a 384-bit digest, and SHA-512 a 512-bit digest. MD5 and SHA-1 are considered cryptographically broken (collisions can be produced); SHA-256 and SHA-512 are the standards considered secure today and are used in TLS certificates and digital signatures.

Can a hash be reversed?

Quick answerNo, hash functions are one-way; it's mathematically impossible to go from a digest back to the original data. Short or predictable inputs can, however, be found using precomputed rainbow tables — which is why passwords should always be hashed with an added salt.

Related mini tools: HMAC, CRC32, SRI & more

Five extra mini tools commonly needed alongside hashing: keyed signing (HMAC), a classic fast checksum (CRC32), hash format conversion, Subresource Integrity (SRI) tag generation, and hash algorithm identification.

🔑HMAC signing
Sign a message with a secret key — used for webhook verification and API request signatures.
🧮CRC32 checksum
A classic, very fast checksum — widely used in zip/archive formats and network protocols.
🔁Hex ⇄ Base64
Convert a hash you got from another tool between hex and Base64.
🛡️SRI hash generator
Generate a Subresource Integrity (SRI) hash for a <script> or <link> tag from pasted file content.
🔍Hash identifier
Paste an unknown hash and get a best guess at which algorithm produced it, based on length and character set.

Hash algorithm reference tables

Citable algorithm comparisons, verified example hash values, and a use-case guide.

Hash algorithms — bit length, hex character count, and security status
AlgorithmBitsHex charsSecurity status
MD512832Weak — collisions found, checksums only
SHA-116040Weak — not recommended for cryptographic use
SHA-25625664Strong — general-purpose standard
SHA-38438496Strong — truncated form of SHA-512
SHA-512512128Strong — longest digest length
CRC32 (bonus)328Not cryptographic — error detection only

The SHA family is computed with the browser's Web Crypto API; MD5 and CRC32 with pure JavaScript.

Verified example hash values (compare against your own calculation)
InputAlgorithmHash (hex)
(empty text)MD5d41d8cd98f00b204e9800998ecf8427e
(empty text)SHA-256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
"The quick brown fox jumps over the lazy dog"MD59e107d9d372bb6826bd81d3542a419d6
"The quick brown fox jumps over the lazy dog"SHA-256d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
"The quick brown fox jumps over the lazy dog"SHA-51207e547d9586f6a73f73fbac0435ed76951218fb7d0c8d788a309d785436bbb642e93a252a954f23912547d1e8a3b5ed6e1bfd7097821233fa0538f3db854fee6

"The quick brown fox…" is a universal test sentence commonly used with hash tools. Paste it into the "Text" tab above to verify these values yourself.

Which algorithm should you use, and when?
ScenarioRecommended algorithm
File download integrity checkSHA-256
Legacy system compatibility / fast checksumMD5
High-security digital signaturesSHA-384 / SHA-512
Webhook / API signature verificationHMAC-SHA-256
Archive/zip fast error detectionCRC32
Password storageNeither MD5 nor SHA — use bcrypt/scrypt/Argon2 (server-side, not available in this tool)

Add this tool to your site (embed code)

Embed the hash generator on your own website for free. Copy the code below into your HTML — the tool runs in a simplified view and links back to this page as its source.

The embedded tool has a fixed layout; you can adjust the height value to fit your site. No ads or personal data, runs entirely client-side.

Hash terms glossary

Short definitions of the core terms used in hashing and checksums.

Hash / digestA one-way operation that converts any data into a fixed-length string of characters unique to that data.
ChecksumA short digest computed to verify data integrity, usually produced with CRC32 or MD5/SHA.
CollisionTwo different inputs producing the same hash value. This has been demonstrated in practice for MD5 and SHA-1.
SaltRandom data added before hashing a password; it makes rainbow-table attacks much harder.
HMACA hash-based signature that uses a secret key; it verifies both the integrity and the source of a message.
Hex (hexadecimal)A hash output represented with characters 0-9 and a-f; each byte is expressed as 2 hex characters.
Base64An encoding that represents binary data with a 64-character alphabet; it produces shorter output than hex.
Bit lengthThe size of a hash output in bits (e.g. SHA-256 = 256 bits = 64 hex characters).
Rainbow tableA precomputed table of hashes for common inputs, used to crack unsalted hashes.
CRC32A non-cryptographic, very fast 32-bit checksum used for error detection, not security.
Digital signatureA structure formed by encrypting a data's hash with a private key, verifying both sender identity and integrity.
Web Crypto APIThe browser's built-in cryptography interface; crypto.subtle.digest computes the SHA family of hashes.

In-depth guides

Detailed answers to the most commonly asked questions about hashing.

Why is MD5 no longer considered secure?

MD5 has been vulnerable to collision attacks since 2004: it's practically possible to produce two different inputs that generate the same MD5 digest. That makes MD5 dangerous for security-sensitive work like digital signatures, certificates, or password storage — an attacker could craft a malicious file with the same MD5 as a legitimate one.

Despite that, MD5 remains common because it's very fast and works well for catching unintentional corruption (a dropped download, a disk error). If security matters, prefer SHA-256 or SHA-512; reserve MD5 for speed-first, low-risk checksums.

How do I know if my downloaded file is corrupted?

Most software or file publishers list a SHA-256 or MD5 hash on the download page. After downloading, upload the file to this tool's "File" tab, paste the publisher's hash into the "Expected hash" box, and click "Generate Hash".

The tool computes your file's actual hash and compares it automatically. A match means the file was not corrupted or altered during download. If it doesn't match, try downloading the file again, ideally from a different source.

Should I use SHA-256 or SHA-512?

SHA-256 is today's most widely used standard, with a good balance of speed and security; it's the default in TLS certificates, Git, blockchains, and many other systems. SHA-512 often runs faster on 64-bit processors and produces a longer digest (128 hex characters); it's preferred by systems that want an extra security margin.

In practice, both are considered unbreakable with current technology; the choice usually comes down to compatibility — which one the target system expects. If you're designing a new system, SHA-256 is a safe default.

Frequently asked questions

What is MD5?
MD5 is a hash algorithm that converts data of any length into a fixed 128-bit (32 hex character) digest. It's fast and is still used for non-critical integrity checks such as file checksums. However, it is cryptographically weak — collision attacks exist, so it should not be used for passwords or digital signatures.
How is SHA-256 calculated?
SHA-256 splits data into 512-bit blocks and applies a 64-round compression function to each block, producing a 256-bit (64 hex character) digest. In the browser this is done at hardware speed via crypto.subtle.digest('SHA-256', data); this tool calls that function for you automatically.
How do you check a file's hash?
Upload the downloaded file to the "File" tab; the tool computes its MD5 and SHA-family hash values. Paste the hash the publisher gave you into the "Expected hash" box and the tool compares it automatically. A match confirms the file was not corrupted or altered.
What is a hash used for?
A hash is used as a unique, fixed-length, one-way fingerprint of data for file integrity verification, password storage, digital signatures, and blockchains. Changing even a single bit of the data changes the hash completely.
What's the difference between MD5 and SHA?
MD5 produces a 128-bit digest and is cryptographically broken; it's recommended only for fast checksum work. The SHA family (SHA-1/256/384/512) produces longer digests; SHA-256 and SHA-512 are considered secure today and used in digital signatures and TLS certificates.
Is an online hash tool safe to use?
In this tool, all computation happens inside your browser; the text or file you provide is never sent to, saved on, or uploaded to any server. MD5 is computed with our own JavaScript code, and the SHA family with the browser's built-in Web Crypto API. This makes it safe to hash confidential documents.
Can a hash be reversed back to the original data?
No. Hash functions are one-way; it's mathematically impossible to recover the original data from a digest. Short or predictable inputs can, however, be found using precomputed rainbow tables, which is why passwords should be hashed with an added salt.
Which hash algorithm should I use?
For general-purpose and security-sensitive work, SHA-256 is a good default; systems wanting a longer digest prefer SHA-512. MD5 and SHA-1 should only be used for legacy compatibility or fast checksums. For scenarios like webhook signing, use HMAC-SHA256 instead of a plain hash.
What is a Subresource Integrity (SRI) hash?
SRI is a browser security feature: adding an integrity="sha384-..." attribute to a <script> or <link> tag makes the browser verify the file's hash before running it, and refuse to load it if a CDN is compromised and the file was tampered with. Use the SRI hash generator mini tool above to build the value and the ready-to-use tag from pasted file content.
How can I identify an unknown hash algorithm?
Length is the strongest clue: 32 hex chars = MD5, 40 = SHA-1, 64 = SHA-256, 128 = SHA-512, and a $2a$/$2b$ prefix means bcrypt. The Hash identifier mini tool above checks length, character set, and common prefixes automatically to suggest the likely algorithm(s).

Methodology & sources

ToolPico's Hash Generator is a free, independent tool. SHA-1, SHA-256, SHA-384, and SHA-512 are computed with the browser's standard Web Crypto API (crypto.subtle.digest) — an interface standardized by the W3C and built into every modern browser. MD5 and CRC32 are computed with our own pure JavaScript implementations that follow the RFC 1321 and ITU-T CRC-32 specifications; no external library or CDN is used.

Sources: NIST FIPS 180-4 (Secure Hash Standard) · RFC 1321 (MD5) · W3C Web Cryptography API. Last updated: July 19, 2026. Results are fully algorithmic and deterministic; every browser produces the same hash for the same input.

Explore all ToolPico tools →

🔗 Add this tool to your site

Copy the code below into your own site. The tool is free, always up to date, and runs entirely on your page. No sign-up required.

Preview →
⚡ Built with ToolPico · toolpico.com