Hash Generator

What a hash is for

A hash turns any amount of data into a short fixed-length fingerprint. Change one bit of the input and the output changes completely and unpredictably. That makes it good for one thing above all: answering "is this the same file?" without comparing the files themselves.

It's one-way. There is no undoing a hash, no "hash decoder", and nothing on this page can turn a fingerprint back into what made it. If you need something reversible you wantBase64 or encryption, not this.

Checking a download

This is the job most people are here for. A project publishes a checksum beside its download; you hash the file you actually received and compare. If they match, your copy is byte for byte what was published — no truncated transfer, no corrupted disk, no swapped file.

Paste the published checksum into the box above and it does the comparing. You don't have to say which algorithm it is: the length gives it away, since no two here are the same width. A whole line copied out of a SHA256SUMS file works, as dosha256:… prefixes, upper case, base64, and the spaced-out form Windows'certutil prints.

Which one should I use?

• SHA-256 — the default. What signatures, certificates and package locks use. Pick this unless something tells you otherwise.
• MD5 and SHA-1 — broken for security. Two different files can be deliberately made to share an MD5, and the same has been demonstrated for SHA-1. They are still perfectly good at catching an accident, which is why download pages still publish them, but never rely on them where someone might be trying to fool you.
• SHA-384 and SHA-512 — the same family, wider. SHA-384 is the usual pick for a Subresource Integrity attribute; the base64 form above is exactly what goes after sha384-.
• CRC-32 — not a cryptographic hash at all. It's a checksum designed to catch transmission errors, and it's what a zip file stores. Forging one is trivial.

Hashing a file

The file is read on your device in chunks — that's what the progress bar is tracking — and all six hashes come out of the same pass. Nothing is uploaded, which for this tool matters more than for most: people hash private keys, database dumps and disk images, and none of that should be leaving the machine to find out its fingerprint.

Why doesn't my hash match theirs?

For a file, a mismatch means the bytes differ — the download is incomplete or corrupt, or it isn't the same release. For text, the usual culprit is a trailing newline: hashinghello and hello\n gives completely different answers, and a text file almost always ends with one. Line endings do it too — a file saved on Windows with\r\n hashes differently from the same text with \n.

Is it private?

Yes. Everything happens in JavaScript inside this page. SHA-1 through SHA-512 come from the browser's own crypto engine; MD5 and CRC-32 are implemented here, because browsers deliberately don't offer MD5. Nothing is uploaded, nothing is logged, and there is no server to send it to. You can disconnect from the internet after the page loads and it keeps working.

Frequently asked questions

Can I get the original back from a hash?

No, and nothing can. A hash throws information away — every file in the world of any size maps into the same 256 bits. Sites that claim to "decode" an MD5 are looking it up in a table of hashes of common passwords, which only works for inputs someone has already hashed.

Should I hash passwords with this?

No. Passwords need a slow, salted, purpose-built function — bcrypt, scrypt or Argon2 — because the speed that makes SHA-256 good here is exactly what makes it a poor password hash. A fast hash can be guessed against at billions of attempts a second.

Does it handle large files?

Up to 512 MB, read in chunks with a progress bar. Above that a browser tab starts running out of room to hold the file, and the command line is a better tool for the job:shasum -a 256 file.iso on macOS or Linux,certutil -hashfile file.iso SHA256 on Windows.

Why is the same text giving a different hash elsewhere?

Almost always a newline, or a different character encoding. Text here is converted to UTF-8 before hashing, which is what virtually every server and command-line tool does.