How to use
- Choose Text to hash what you type, or File to hash a file from your device.
- All five hashes are computed at once — there is nothing to select.
- Toggle Uppercase if the system you are comparing against prints hex in caps.
- Click the copy button on any row to take that value.
About hashing
A hash function takes input of any size and produces a fixed-length fingerprint. The same
input always yields the same output, a one-byte change yields a completely different output,
and the output reveals nothing useful about the input. Those three properties make hashes
the standard way to answer “is this the same data?” without comparing the data itself.
The catch is that not all hash functions still hold up. MD5 was broken in 2004, when a
method for constructing two different inputs with the same digest was published. SHA-1
followed in 2017, when Google produced two distinct PDFs sharing a SHA-1 hash. Both remain
in wide use — Git still identifies objects by SHA-1 — but neither should be used where
someone benefits from forging a match, such as signatures or certificate validation.
SHA-256 and SHA-512 are members of the SHA-2 family and currently have no practical
attacks. SHA-512 is not simply “more secure” than SHA-256; it uses 64-bit operations, which
makes it faster than SHA-256 on 64-bit hardware despite producing a longer digest. Pick
SHA-256 unless something specifically calls for SHA-512.
One misuse is common enough to call out: hashing is not encryption. Encryption is reversible
with a key, and that is the point of it. Hashing is one-way by design, and cannot protect
data you need to read back. Nor is a bare hash sufficient for passwords — see the FAQ.
Frequently asked questions
Is my file uploaded anywhere?
No. The file is read with the browser's File API and hashed locally by JavaScript. There is no server here that could receive it. You can verify this by opening your browser's network tab while hashing a file — no request is made.
Is MD5 still safe to use?
Not for anything security-related. Practical collision attacks against MD5 have existed since 2004, and today two different files with the same MD5 can be produced in seconds on a laptop. That said, MD5 is perfectly fine where you only need to detect accidental corruption — verifying a download completed intact, or using a hash as a cache key. The distinction is whether an attacker benefits from forging a match.
Why does my browser not offer MD5 natively?
The Web Crypto API deliberately omits MD5, and SHA-1 is included only for legacy compatibility. Browser vendors did not want to make a broken algorithm the path of least resistance. That is why this tool implements MD5 itself, while SHA-1 through SHA-512 use the browser's native implementation.
Can I get the original text back from a hash?
Not by reversing it — hashing discards information, so the reverse function does not exist. But that is a weaker guarantee than it sounds. For short or common inputs, an attacker simply hashes billions of candidates and looks yours up. Sites with leaked password databases fall to exactly this. Unsalted hashes of predictable inputs are not secret.
Why does another tool give a different hash for the same file?
Almost always a line-ending difference. A text file saved on Windows uses CRLF and on Unix uses LF; those are different bytes, so they hash differently. If you are comparing hashes of text pasted between systems, check the line endings before assuming something is wrong. Byte-for-byte identical input always produces an identical hash.
Should I hash passwords with SHA-256?
No. SHA-256 is designed to be fast, which is exactly wrong for passwords — it lets an attacker try billions of guesses per second on a GPU. Password storage needs a deliberately slow, salted function: bcrypt, scrypt or Argon2. Use SHA-256 for integrity, not for credentials.