Generate MD5, SHA-1, SHA-256, SHA-512 cryptographic hashes instantly. Verify file integrity, create checksums, secure passwords. 100% browser-based—your data never leaves your device.
Downloaded a file? Compare its SHA-256 hash against the publisher's checksum to ensure it wasn't corrupted or tampered with during download. Linux ISOs, software installers, and firmware updates always provide checksums.
Never store plain text passwords! Generate SHA-256 hashes for password storage. Even if your database leaks, attackers can't reverse the hash to get original passwords. Use with salt for production systems.
Need to check if two files are identical without comparing byte-by-byte? Generate MD5 hash for both. Same hash = identical files. Perfect for deduplication, backup verification, or finding duplicate photos.
Generate consistent unique IDs from text input. Hash user emails, device info, or content to create reproducible unique identifiers for databases, caching keys, or API tokens without storing original data.
Track file modifications by storing hashes. If hash changes, content changed. Git uses SHA-1 this way. Monitor config files, legal documents, or source code for unauthorized changes.
Need strongest cryptographic security? Use SHA-512 for digital signatures, certificate generation, or high-security password hashing. 512 bits makes collision attacks computationally infeasible.
| Algorithm | Hash Length | Security | Best For |
|---|---|---|---|
| MD5 | 128 bits (32 chars) | Weak | Checksums, non-security |
| SHA-1 | 160 bits (40 chars) | Deprecated | Legacy systems, Git |
| SHA-256 | 256 bits (64 chars) | Strong | Most use cases |
| SHA-512 | 512 bits (128 chars) | Maximum | High security needs |
A cryptographic hash function takes input of any length — a word, a document, a 4 GB disk image — and produces a fixed-length fingerprint. SHA-256 always outputs 256 bits (64 hex characters), whether you hash one letter or an entire hard drive. Three properties make hashes useful: the same input always produces the same output (deterministic), you can't work backwards from a hash to the input (one-way), and changing even one bit of input completely changes the output (avalanche effect). Hash "hello" and "Hello" and the two results share nothing recognizable.
MD5 (128-bit, 1992) is cryptographically broken — researchers can manufacture two different files with the same MD5 in seconds. It survives only as a quick checksum for accidental corruption, never for security. SHA-1 (160-bit) fell in 2017 when Google demonstrated a practical collision; browsers and git have been moving away from it since. SHA-256, part of the SHA-2 family, is the current standard — it secures TLS certificates, software signatures, and Bitcoin. SHA-512 is its bigger sibling: a longer digest and actually faster on 64-bit CPUs, common in high-security contexts.
Practical rule: use SHA-256 unless something forces otherwise. Use MD5 only to match a legacy checksum someone else published. Never use MD5 or SHA-1 for anything an attacker might target.
Verifying downloads. Software sites publish a SHA-256 checksum next to the download link. Hash your downloaded file and compare — if the fingerprints match, the file arrived intact and unmodified. A single differing character means corruption or tampering.
Detecting duplicates and changes. Two files with the same SHA-256 are, for all practical purposes, identical — handy for deduplicating photo libraries or confirming a backup matches its source without comparing byte by byte.
Development work. Generating cache keys, ETags, and content-addressable identifiers; checking what value a system "should" have computed; understanding how git commit IDs (SHA-1 hashes of content) actually work.
No — hashing is one-way and destroys information; a 64-character digest cannot contain a 10 MB document. What attackers do instead is guess: hash billions of candidate inputs and look for a match. That works against short, common inputs like weak passwords, which is why password storage adds salt and slow algorithms.
Yes — hashing runs entirely in your browser via the Web Crypto API. Nothing you type is transmitted anywhere.
That's the avalanche effect, and it's deliberate: if similar inputs produced similar hashes, attackers could home in on an input gradually. Any bit flip should change roughly half the output bits.
No. Password storage needs salted, deliberately slow algorithms — bcrypt, scrypt, or Argon2 — not a fast general-purpose hash. Fast hashes let attackers test billions of guesses per second. For creating strong passwords in the first place, use our Password Generator.
Vanishingly small — about 1 in 2256, a number with 77 digits. No SHA-256 collision has ever been found; you could hash every file on Earth and not expect one.