Toolrack

Hash Generator

—
—
—
—

Hashing uses the Web Crypto API on your device. Files are never uploaded.

Compute SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files using the browser's built-in Web Crypto API. Files are hashed locally, whatever their size.

Verifying a download

  1. Copy the SHA-256 checksum published alongside the download.
  2. Switch to the File tab and drop your downloaded file in.
  3. Paste the published checksum into the compare box.

A match means your copy is byte-for-byte identical to what was released. A mismatch means the file is corrupt or has been tampered with — in either case, do not run it.

Algorithm reference

AlgorithmOutputStatus
SHA-1160 bits, 40 hex charsBroken — legacy only
SHA-256256 bits, 64 hex charsCurrent standard
SHA-384384 bits, 96 hex charsSecure
SHA-512512 bits, 128 hex charsSecure, fast on 64-bit

Note the avalanche effect: change one character of the input and roughly half the output bits flip. There is no such thing as a hash that is "close" to another — it either matches exactly or tells you nothing.

Frequently asked questions

Why is there no MD5 option?

The Web Crypto API deliberately omits MD5 because it is cryptographically broken — collisions can be produced in seconds on ordinary hardware. Adding it would mean shipping a separate implementation and implying it is still fit for purpose. SHA-256 is the sensible default for anything new.

What is a checksum used for?

Verifying that a file arrived intact and unmodified. Software projects publish the SHA-256 of each download; you hash your copy and compare. If a single byte changed in transit — or someone substituted the file — the hash differs completely. Matching hashes mean you have exactly the bytes the publisher released.

Can I get the original text back from a hash?

No. Hashing is one-way by design and the output is fixed-length regardless of input size, so information is necessarily discarded. What an attacker can do is hash billions of likely inputs and look for a match, which is why hashing passwords with a plain SHA function is inadequate — those need a slow, salted algorithm such as Argon2 or bcrypt.

Which SHA variant should I choose?

SHA-256 for essentially everything — it is the industry default, widely supported and has no known practical weakness. SHA-512 is not meaningfully more secure in practice but is faster on 64-bit hardware for large inputs. SHA-1 is broken and should only be used to check against legacy systems that still publish it.

Related tools