Generate MD5, SHA-1, SHA-256, SHA-512 hashes from text or a file, right in your browser — no upload.
Algorithms
Type text above to see hashes
Everything runs in your browser. No file or text is ever uploaded.
SHA-1, SHA-256, SHA-384 and SHA-512 are computed using the browser's native crypto.subtle.digest() API — no libraries, no network calls. MD5 is computed with spark-md5 (Web Crypto does not expose MD5 because it is cryptographically broken). Everything runs locally in your tab.
You can hash any text string — passwords, API keys, JSON payloads — or any local file up to 500 MB including disk images, ISOs and archives. The file is read into your browser's memory using file.arrayBuffer() and then passed directly to the crypto functions. It is never sent to our servers.
SHA-256
recommended256-bit output (64 hex chars). The modern standard for file integrity, digital signatures and most security protocols. Use this as your default.
SHA-512
high security512-bit output (128 hex chars). Stronger than SHA-256, preferred in high-security contexts. Slower on 32-bit systems but negligible on modern hardware.
SHA-1
deprecated160-bit output (40 hex chars). Deprecated for security use — practical collision attacks exist. Still common in legacy systems and Git object IDs.
MD5
legacy only128-bit output (32 hex chars). Cryptographically broken. Use only for non-security checksums, file deduplication, or when a legacy system requires it.
Is my file actually uploaded when I hash it?
No. This tool uses your browser's built-in Web Crypto API and SparkMD5 to compute hashes entirely on your device. Your file never leaves your computer and is never sent to any server.
Which hash algorithm should I use?
Use SHA-256 for integrity checks, file verification, and general-purpose hashing — it is the modern standard. SHA-512 provides a larger digest and is preferred in some security contexts. SHA-1 is deprecated for security use but still common in legacy systems. MD5 is considered cryptographically broken and should only be used for legacy checksums or non-security purposes like quick file deduplication.
What is MD5 and is it secure?
MD5 produces a 128-bit (32 hex characters) hash. It is NOT secure for cryptographic purposes because collisions can be engineered. Use it only for checksums, quick file deduplication, or when a legacy system requires it. For any security-sensitive use case, choose SHA-256 or stronger.
How do I verify a file's checksum to confirm it hasn't been tampered with?
Select the same algorithm the file publisher used (usually SHA-256 or MD5). Drop your downloaded file into this tool, compute the hash, and compare it character by character with the checksum the publisher provided. If they match, the file is authentic and unmodified.
Can I hash large files like disk images or ISOs?
Yes. This tool supports files up to 500 MB. The hashing is done with the Web Crypto API (SHA-*) and SparkMD5 (MD5), both of which process the raw bytes in your browser's memory without any upload. Very large files may take a few seconds; please keep the tab active during computation.
What is the difference between a hash and encryption?
A cryptographic hash is a one-way function — it produces a fixed-length fingerprint of the input that cannot be reversed to recover the original data. Encryption is a two-way process that can be reversed with the correct key. Hashes are used for integrity verification; encryption is used for confidentiality.