Hash Generator

Hash Generator computes five cryptographic hashes (MD5, SHA-1, SHA-256, SHA-384, SHA-512) for any text or uploaded file. All computation happens locally in your browser.

How each algorithm is implemented

• SHA-1, SHA-256, SHA-384, SHA-512 — delegated to crypto.subtle.digest(), the browser’s built-in Web Crypto. Hardware-accelerated and standards-compliant.
• MD5 — implemented directly in TypeScript using the canonical RFC 1321 reference. ~200 lines, no third-party crypto library needed. MD5 is broken for security purposes but still useful for checksums and legacy compatibility.

When to use which

• MD5 — 128-bit hex (32 chars). Useful for verifying file integrity from old archives or checking git-tree hashes. Do not use for password storage, signature schemes, or anything with security requirements.
• SHA-1 — 160-bit (40 chars). Same story — historically used for git commits (now SHA-256). Do not use for new security applications.
• SHA-256 — 256-bit (64 chars). The default for modern applications: TLS, Bitcoin, JWT, software distribution. Use this for nearly everything today.
• SHA-384 — 384-bit (96 chars). Same algorithm family as SHA-256, slightly longer. Sometimes used in TLS.
• SHA-512 — 512-bit (128 chars). Faster on 64-bit hardware. Used for some backup / integrity tools.

Inputs

• Text — type or paste anything. UTF-8 encoded.
• File — up to multi-hundred-MB; everything happens in memory. Browser will queue the whole file before hashing.

Privacy

The text or file never leaves your browser. Pure local computation. No upload.

About case

By default output is lowercase hex (the convention). Tick the upper-case checkbox if you need the uppercase form — for example, to match an SHA-256 checksum rendered in all-caps by some tooling.

Common use cases

• Verifying downloads. Paste a downloaded file into the File tab and compare its SHA-256 digest against the checksum published on the vendor site to confirm the file arrived intact and untampered.
• Cache busting and content addressing. Use a digest of an asset or payload as an ETag, cache key, or content-addressed filename so clients refetch only when bytes actually change.
• Comparing without diffing. Hash two configuration snippets or exports and compare the digests to prove they are byte-identical, even when they live on different machines.
• Legacy compatibility. Produce MD5 or SHA-1 checksums for older systems, package mirrors, or storage APIs that still publish or require them.
• Learning and debugging. See all five algorithms side by side for the same input, which makes the digest-length differences between MD5, SHA-1, and the SHA-2 family immediately visible.

How to use

1. Stay on the Text tab (the default) and type or paste your content into the textarea. All five digests recompute automatically on every keystroke.
2. Switch to the File tab and choose a file to hash its raw bytes instead; the file name and size appear next to the picker.
3. Read the results in the five rows — MD5, SHA-1, SHA-256, SHA-384, and SHA-512 — all computed from the same input.
4. Toggle Uppercase to switch the hexadecimal output between lowercase and uppercase.
5. Click the copy icon beside any digest to place that single value on your clipboard.
6. Use Sample to hash the classic pangram The quick brown fox jumps over the lazy dog, and Clear to reset everything. The status line confirms the input size and that all five algorithms ran.

Tips and pitfalls

Treat MD5 and SHA-1 as checksums, not security primitives. Practical collision attacks against MD5 have existed since 2004, and SHA-1 fell to a demonstrated chosen-prefix collision with the SHAttered attack in 2017, later made cheaper. If an adversary can influence the input, use SHA-256 or SHA-512. For detecting accidental corruption — a truncated download, a flaky transfer — any of the five works.

Never store passwords with these functions. General-purpose hashes are deliberately fast, which is exactly what makes brute-forcing them cheap, and the digests shown here are unsalted. Password storage needs a memory-hard, salted key-derivation function such as Argon2id, bcrypt, scrypt, or PBKDF2. Also remember that hashing is one-way and is not encryption: you cannot recover the input from a digest, and anyone who guesses the input can reproduce it.

Byte-exactness matters when comparing with other tools. Text here is UTF-8 encoded exactly as typed — a trailing newline, a CRLF line ending, or a different encoding yields a different digest. On the command line, echo appends a newline, so use printf or echo -n to match this tool. Files are hashed as raw bytes but are read fully into memory, so extremely large files will consume corresponding RAM.

FAQ

Is my text or file uploaded anywhere when I hash it?

No. All five digests are computed locally in your browser: the SHA family uses the Web Crypto API, and MD5 is calculated by an in-page implementation of RFC 1321. Text and file contents never leave your device.

Why does my hash not match the one from another tool?

Digests are computed over exact bytes, so invisible differences change the result. This tool UTF-8 encodes exactly the characters in the input box. Command-line tools such as echo append a trailing newline, and editors may save with different line endings or encodings, all of which produce different hashes.

Can I use MD5 or SHA-256 to store user passwords?

No. General-purpose hashes are designed to be fast, which makes them easy to brute-force, and they are unsalted here. Password storage requires a deliberately slow, salted key-derivation function such as Argon2id, bcrypt, scrypt, or PBKDF2.

Why is MD5 still offered if it is considered insecure?

MD5 is broken for collision resistance, so it must not be used where an attacker can craft inputs. It remains fine for detecting accidental corruption in downloads or transfers, and some legacy systems and storage APIs still require MD5 checksums for compatibility.

Does the uppercase option change the hash?

No. A digest is a fixed sequence of bytes; the option only switches the hexadecimal letters between lowercase and uppercase for display and copying. Both spellings represent the identical value.

What does the status line mean by chars times 5 algorithms?

It reports the length of the input (in characters for text, or the file name and byte size for files) and confirms that all five algorithms — MD5, SHA-1, SHA-256, SHA-384, and SHA-512 — were computed from that same input.