Hash Generator
The MD5 hash of the text "abc" is 900150983cd24fb0d6963f7d28e17f72 and its SHA-256 is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Both are the published test vectors in RFC 1321 and FIPS 180-4.
How to use
- Type or paste text, or switch to File and choose a file from your device. The five hashes appear as you type.
- Press Copy next to the hash you need. Tick Uppercase if your checksum list uses capital letters.
- To verify a download, paste the checksum from the publisher into Compare with a hash. The tool picks the algorithm from the length and tells you whether it matches.
- Spaces, colons and upper or lower case in the pasted checksum are ignored.
How it works
A hash function turns any input into a fixed-size fingerprint. The same bytes always give the same hash, and changing a single bit gives a completely different one. Text is converted to UTF-8 bytes first, so the same words in another encoding give a different hash.
MD5 (RFC 1321) pads the input to a multiple of 64 bytes, then mixes each block through 64 steps using the constants floor(2^32 x |sin(i + 1)|). The result is 128 bits, shown as 32 hex characters. This tool implements it directly and checks itself against the seven RFC 1321 test strings and a million-letter input.
SHA-1, SHA-256, SHA-384 and SHA-512 (FIPS 180-4) are computed by crypto.subtle.digest, the hashing function built into your browser. Files are read into memory on your device and hashed there. Nothing is sent to a server, and files above 256 MB are refused because they would not fit.
Comparing is done on the normalized hex string. The length decides the algorithm: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512.
Which algorithm to use
MD5 and SHA-1 are broken for security: researchers can build two different inputs with the same hash. They are still fine for catching accidental corruption and for matching a checksum a site publishes. For anything that must resist tampering, use SHA-256 or longer.
| Algorithm | Output length | Hex characters | Use today |
|---|---|---|---|
| MD5 | 128 bits | 32 | Checksums only, not security |
| SHA-1 | 160 bits | 40 | Legacy checksums, not security |
| SHA-256 | 256 bits | 64 | Default choice |
| SHA-384 | 384 bits | 96 | Longer margin, same SHA-2 family |
| SHA-512 | 512 bits | 128 | Fast on 64-bit CPUs |
Test vectors for the text abc
Every standard publishes the hash of the three letters abc so implementations can be checked. This tool starts with abc filled in, and its output matches these values.
| Algorithm | Hash of abc |
|---|---|
| MD5 | 900150983cd24fb0d6963f7d28e17f72 |
| SHA-1 | a9993e364706816aba3e25717850c26c9cd0d89d |
| SHA-256 | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
Standards
MD5 is implemented in this tool from the specification and checked against the RFC test suite. The SHA family uses the Web Crypto API built into your browser.
| Standard | Defines | Where |
|---|---|---|
| RFC 1321 | MD5 message digest algorithm | https://www.rfc-editor.org/rfc/rfc1321 |
| FIPS 180-4 | SHA-1, SHA-256, SHA-384, SHA-512 | https://csrc.nist.gov/pubs/fips/180-4/upd1/final |
| Web Crypto API (W3C) | crypto.subtle.digest in browsers | https://www.w3.org/TR/WebCryptoAPI/ |
FAQ
Is my file uploaded anywhere?
No. The file is read by your browser and hashed on your device. You can disconnect from the internet after the page has loaded and it still works.
Is MD5 safe to use?
Not for security. Two different inputs with the same MD5 can be produced on purpose, so it cannot prove a file was not tampered with. It is still handy to detect accidental corruption or to match a checksum a site lists. Use SHA-256 for anything that matters.
Why does my hash differ from another tool for the same text?
Most often the input bytes differ: a trailing newline, a different line ending (CRLF or LF), or a different encoding. This tool hashes the text exactly as typed, as UTF-8, with no newline added. Use the File mode to hash the exact bytes of a file.
How do I check a downloaded file?
Open the File tab, choose the downloaded file, and paste the SHA-256 value from the download page into Compare with a hash. A green Match means the file is identical to what the publisher hashed. If the checksum comes from the same page as the download, it only proves the transfer was not corrupted.
What is the largest file I can hash?
The limit is 256 MB, because the whole file is held in memory while hashing. For larger files use sha256sum on Linux, shasum -a 256 on macOS or Get-FileHash in PowerShell.
Does it hash passwords?
It computes a plain hash, which is the wrong tool for storing passwords. Password storage needs a slow, salted function such as bcrypt, scrypt or Argon2.