crypto
Hash generator
MD5, SHA-1, and SHA-256 hashes computed locally from text or a file.
Runs 100% in your browser. Nothing you paste is uploaded, stored, or sent to a server.
How to use
- Type or paste text, or choose a local file. The file is read with the File API and never uploaded.
- Hashes update for MD5, SHA-1, and SHA-256. Toggle uppercase if a runbook expects capital hex.
- Copy a single digest. Compare it to a published checksum to verify a download.
- Remember that MD5 and SHA-1 are broken for collision resistance. Prefer SHA-256 for new work.
A cryptographic hash is a fixed-size fingerprint of some bytes. Matching checksums is how you confirm a downloaded ISO, a released tarball, or a copied artifact is the one you expected. This generator computes MD5, SHA-1, and SHA-256 in the page using a small MD5 implementation plus the Web Crypto API for the SHA family.
Because the bytes never leave the machine, you can hash a build that contains secrets or customer fixtures. That is not something you should do with a web form that posts to a server, even over HTTPS.
Examples
Text: hello
MD5 5d41402abc4b2a76b9719d911017c592, SHA-1 aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d, SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
Empty string
MD5 of zero bytes is d41d8cd98f00b204e9800998ecf8427e. If you see that unexpectedly, your input did not make it into the hasher.
File checksum
Pick a local file and compare the SHA-256 to the value on the vendor’s site. A mismatch means a corrupt or swapped download.
Which algorithm should you use?
MD5 is fast and still common on older mirrors, but collisions are practical. Do not use it to prove integrity against an attacker. SHA-1 is likewise broken for collision resistance. SHA-256 is the default for new checksums and for content-addressed stores.
These are hex digests of the raw bytes, not HMAC, not bcrypt, and not a password-storage scheme. Hashing a password with SHA-256 and storing it is not authentication. Use a password KDF (Argon2, scrypt, bcrypt) on a server.
The MD5 implementation is self-contained TypeScript so the page does not need a WASM download. SHA-1 and SHA-256 go through crypto.subtle.digest.
FAQ
Why offer MD5 at all?
Because a lot of existing checksum files still publish it. The page labels the algorithms so you can match a legacy digest without making MD5 your default.
Can I hash a file larger than memory?
The current implementation reads the file into an ArrayBuffer. Very large videos may strain the tab. For multi-gigabyte ISOs, a local CLI (sha256sum) is a better fit.
Is this suitable for password storage?
No. Use a slow, salted password KDF on a server. A SHA-256 of a password is not a stored credential.
Does the file get uploaded?
No. FileReader plus Web Crypto stay inside the browser.