Hash Generator
Compute MD5, SHA-1, SHA-2, SHA-3, BLAKE2 and CRC-32 digests of text or of a file, all at once.
Your lid
Pin tools here. They are saved in this browser.
Pin a tool and its sticker lands here.
About this tool
What a hash is for
A hash function turns input of any length into a short digest of fixed length. The same input always gives the same digest, and with the cryptographic functions on this page a change of a single bit gives a digest that looks unrelated to the first. That makes a digest a fingerprint: if two digests differ, the inputs differ, and if they are equal, the inputs are almost certainly identical, with no need to compare them byte by byte.
Typical uses are verifying a download against the checksum its publisher lists, detecting duplicate or changed files, and building cache keys.
Which algorithm to choose
For anything security related use SHA-256, SHA-512, SHA-3 or BLAKE2. MD5 and SHA-1 are broken for security purposes, because two different inputs with the same digest can be produced on purpose, but they are still common as plain checksums. CRC-32 is not a cryptographic hash and only detects accidental corruption.
None of these is suitable for storing passwords, because they are designed to be fast. For passwords use a slow, salted function such as bcrypt.
SHA3-256 here is the function standardised in FIPS 202. The Keccak-256 used by Ethereum predates that standard and gives different digests for the same input.
How the digests are computed and written
The digests are computed by Go's hash packages (the standard library, and golang.org/x/crypto for BLAKE2) compiled to WebAssembly and run in a Web Worker, off the main thread of the page. A file is read in slices of 8 MB, so a large file is hashed without being loaded into memory whole, and it does not leave your device.
A digest is a sequence of bytes. hex and HEX write each byte as two hexadecimal digits, and base64 writes the same bytes in Base64, the form used in Subresource Integrity attributes. The comparison field accepts either notation, with or without the algorithm name in front, as in sha256-… or sha256:….
Questions
Is my file uploaded to compute the hash?
No. The file is read by your browser and hashed on your device. The tool sends it nowhere, and the site's Content-Security-Policy does not let the page connect to any other host.
Why does my MD5 differ from the one another tool gives?
The usual cause is input that differs invisibly: a trailing newline, Windows line endings, a byte order mark or a different text encoding. This tool hashes the characters in the box encoded as UTF-8 and adds nothing. A line break in the box is always a single line feed, so to hash text that has Windows line endings, save it and hash the file.
Can a hash be reversed to get the original text?
No. A hash function discards information, so there is nothing to decrypt. Short or common inputs can still be found by guessing and comparing, which is why passwords need a slow, salted function.
What is the difference between SHA-2 and SHA-3?
They are different designs, both standardised by NIST. SHA-2, the family of SHA-256 and SHA-512, is the long-standing default. SHA-3 is built on the Keccak sponge construction and was standardised as an alternative of a different design, in case a weakness is ever found in SHA-2. Both are considered secure today.