Drop a file or click to upload — its bytes are hashed locally.
Free, no sign-up
Hashed in your browser
Web Crypto + local MD5
A hash generator reduces any input to a fixed-length fingerprint you can compare against a published value; this one derives the SHA digests from the browser's built-in Web Crypto API and MD5 from a small local script. Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums of any text or file, right in your browser. Verify a download, match a published checksum, or fingerprint data — instant and private, nothing uploaded.
Three steps, all in your browser.
Type or paste text into the box, or drag a file onto the upload area. The hashes update live as you type, and a file is hashed over its exact bytes the moment you drop it.
Toggle MD5, SHA-1, SHA-256, SHA-384 or SHA-512 — any combination. SHA-256 is the modern default for verifying downloads; MD5 and SHA-1 are there for matching legacy checksums.
Copy any hash with one click and compare it to a published checksum. Need a unique identifier instead of a fingerprint? Try the UUID Generator. To protect the contents rather than fingerprint them, use Secure Notes.
Digest size, hex length and security status for the five algorithms this tool computes.
| Algorithm | Digest size | Hex characters | Security status |
|---|---|---|---|
| MD5 | 128 bits | 32 | Cryptographically broken — checksums and corruption checks only |
| SHA-1 | 160 bits | 40 | Cryptographically broken — checksums and corruption checks only |
| SHA-256 | 256 bits | 64 | Recommended — the modern default for verifying downloads |
| SHA-384 | 384 bits | 96 | Recommended — longer digest, no known practical weaknesses |
| SHA-512 | 512 bits | 128 | Recommended — longest digest, can be faster on 64-bit systems |
Every hash is a fixed length no matter how large the input: a one-character note and a 2 GB disk image both produce a 64-character SHA-256. Hex characters are simply the digest size in bits divided by four, because each hex character encodes 4 bits. MD5 and SHA-1 are included for matching legacy checksums — practical collision attacks exist against both, so choose SHA-256 or stronger whenever the result is a security decision.
sha256sum or certutil. This is the usual way to verify a download. The file is read locally and never uploaded; remove it with the clear button to go back to hashing typed text. Very large files take longer and use more memory because the whole file is loaded to hash it.