Hash Generator
Hash text or files with the browser's built-in WebCrypto — data never leaves your device.
How to hash text or a file
- Type or paste text into the box. All four digests (SHA-256, SHA-512, SHA-384, and legacy SHA-1) compute at once, updating a moment after you stop typing.
- Or click "hash a file" and choose any file up to 200 MB. The filename and size appear so you can confirm you picked the right one.
- Copy whichever digest you need with its Copy button. Output is lowercase hex.
A worked example: verifying a download
A software project publishes its installer alongside a SHA-256 checksum. Download the installer, click "hash a file" here, select it, and compare the SHA-256 row against the published value. If every character matches, the file that reached your disk is byte-for-byte the file the publisher hashed; if even one character differs, the download is corrupt or has been tampered with, and you should not run it. To see how sensitive this is, hash the text hello: SHA-256 gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Add a single trailing space and the entire digest changes to 5e3235a8… with nothing in common. That avalanche property is the whole point of a cryptographic hash.
Under the hood: WebCrypto, not a JavaScript library
The hashing is done by crypto.subtle.digest, the WebCrypto API built into your browser, which calls the same vetted native crypto code your browser uses for HTTPS. That means correctness you do not have to take my word for (compare any output here against shasum on a Mac or Linux terminal and they match), and speed that pure JavaScript implementations cannot touch, which is why a 200 MB file cap is even feasible. Text is encoded as UTF-8 before hashing, so results agree with command line tools on non-ASCII input too. Files are read into memory and hashed locally; nothing is uploaded, which is exactly the property you want when hashing anything sensitive.
Honest limitations
There is no MD5, and that is a WebCrypto decision, not an oversight: browsers exclude it because it has been broken for two decades. If a legacy system forces MD5 on you, use a command line tool. SHA-1 is included for compatibility with older systems that still publish SHA-1 checksums, but do not choose it for anything new; collisions have been demonstrated publicly since 2017. The file path loads the entire file into memory before hashing, so the 200 MB cap protects your browser tab rather than being an arbitrary rule, and on a low-memory phone even that may be optimistic. Finally, plain hashes are the wrong tool for storing passwords; that job needs a slow, salted algorithm like bcrypt or Argon2, which no honest browser tool should offer.
Frequently asked questions
Which hash should I use?
SHA-256 is the modern default for checksums and integrity verification. SHA-512 offers a larger digest. SHA-1 is provided only for compatibility with older systems — it is considered broken for security purposes and should not protect anything important.
Why is MD5 not offered?
Browsers' WebCrypto API deliberately excludes MD5 because it has been cryptographically broken for two decades. If a legacy system demands MD5, use a command line tool, but prefer SHA-256 anywhere you have a choice.
Can I verify a downloaded file's checksum here?
Yes. Choose the file, pick the algorithm the publisher used (usually SHA-256), and compare the result to the published checksum. Matching hashes mean the file arrived intact.
Is hashing the same as encryption?
No. A hash is a one-way fingerprint: you cannot recover the original data from it. Encryption is reversible with a key. Hashes verify integrity; encryption protects confidentiality.