Hash & Checksum Generator
Digest text or a file, and verify it against a published checksum.
Drop a file to hash
Any file type — read in your browser, never uploaded
Click to browse, or paste files and links (Ctrl/⌘ + V)
About the Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 over text or a file, and compare the result against a checksum from a release page — the comparison ignores case, spaces and colons, so a pasted value matches without hand-tidying. The SHA family comes from the browser's own WebCrypto; MD5 and CRC32 are implemented here because WebCrypto deliberately omits them and real-world checksums are still published in both forms. They are labelled broken where they appear, which they are: both have practical collision attacks and neither should carry security weight. For passwords, none of these is the right tool — a password needs a deliberately slow, salted algorithm, and a fast hash is what makes guessing cheap.
Are my files or text uploaded?
No. SHA hashing uses the browser's built-in WebCrypto, and MD5 and CRC32 are implemented in JavaScript here. Everything runs in your tab with no network request.
Which algorithm should I use?
SHA-256 for anything new. Use MD5 or SHA-1 only to verify a checksum that was published in that form, and CRC32 only for error detection — a zip or PNG integrity check.
Why are MD5 and SHA-1 marked broken?
Both have practical collision attacks: an attacker can construct two different inputs with the same digest. That makes them unfit for signatures, passwords or any integrity check against a deliberate attacker. They remain fine for spotting accidental corruption, which is why they are here at all.
Can I use this to hash a password?
No — and no general-purpose hash should be used for passwords. A password needs a deliberately slow algorithm with a per-user salt, such as Argon2, scrypt or bcrypt. A fast hash like SHA-256 is exactly the wrong tool, because speed is what makes guessing cheap.
Why does SHA hashing need HTTPS?
Browsers only expose WebCrypto in a secure context, so on a plain http:// page the SHA algorithms are unavailable. MD5 and CRC32 still work, since they do not depend on it.
Does the file hash match what the command line gives?
Yes. The digests are over the exact bytes of the file, so they match sha256sum, md5sum, certutil and the equivalents.
Related: Base64 Encoder · UUID Generator · JWT Decoder
Keywords: hash generator, md5, sha256, sha512, crc32, hmac, checksum verify, file hash, online hash no upload