Loading tool…
ToolWrenCompute MD5, SHA-1, SHA-256 and SHA-512 checksums of any text as you type. SHA hashes use the browser's native Web Crypto API for correctness and speed.
Loading tool…
Hash is a free, private online tool that lets you generate MD5, SHA-1, SHA-256 and SHA-512 hashes of any text instantly in your browser. It runs entirely in your browser, so nothing you enter is uploaded to a server.
Privacy: this tool runs entirely in your browser. Your input is never sent to, received by, or stored on any server — there are no uploads and no tracking of what you enter.
A cryptographic hash function maps input of any size to a fixed-length string (the digest). The same input always yields the same digest, and even a tiny change produces a completely different one — useful for integrity checks and fingerprints.
Use SHA-256 or SHA-512 for security-sensitive work. MD5 and SHA-1 are broken for security but still appear in checksums and legacy systems, so we include them for compatibility.
You cannot reverse a hash back to the original text. To compare values, hash the candidate and compare digests.
A hash function takes any input — a word, a file, a gigabyte database dump — and produces a fixed-length string of characters called a digest or 'fingerprint'. The same input always yields the same digest, but even a one-character change produces a completely different one. Good cryptographic hashes are one-way (you cannot reverse the digest back to the input) and collision-resistant (it is infeasible to find two inputs with the same digest).
This tool computes several algorithms because each has a purpose. MD5 (128-bit) and SHA-1 (160-bit) are fast but cryptographically broken — fine for non-security checksums, unsafe for anything that must resist tampering. The SHA-2 family (SHA-256, SHA-384, SHA-512) is the modern standard for security. CRC32 is not cryptographic at all; it is a tiny checksum used to detect accidental corruption in formats like ZIP, PNG and gzip.
Hashes verify that a downloaded file arrived intact (compare its SHA-256 to the one published by the author). They fingerprint content for caching and deduplication. They underpin digital signatures and blockchains. And — with proper salting and a slow algorithm like bcrypt — they protect stored passwords, so a leaked database does not reveal the actual passwords.
A plain hash proves integrity but not authenticity — anyone can compute it. HMAC (Hash-based Message Authentication Code) mixes a secret key into the hashing process, so only someone who knows the key can produce a valid digest. HMAC is how webhooks prove a payload really came from the sender (Stripe, GitHub and Shopify all sign webhooks this way) and how JWTs are signed with HS256. Enable HMAC mode here and supply the shared secret to reproduce those signatures.
If a hash here does not match one from another tool, the input bytes differ in some invisible way — usually a trailing newline, different line endings (CRLF vs LF), or a different character encoding. This tool hashes the exact UTF-8 bytes of what you type. For files, it reads the raw bytes, so the digest matches command-line tools like sha256sum.
All hashing happens in your browser: text via the Web Crypto API (and a JS implementation for MD5/CRC32), files read locally with no upload. That makes it safe for sensitive content. The built-in compare box lets you paste a known hash and instantly confirm whether your input matches it — the quickest way to verify a download or check that two values are identical.