Skip to content
cliplimeClipLime

Generate MD5, SHA-1 and SHA-256 hashes

Hash text or a whole file on your device, then check it against the hash you were given.

Runs on your device, nothing is uploaded

Hashes update as you type.

Your text

Hashes

Working out the hashes…

Paste the hash you expect. It can be hex, Base64, or a whole line from sha256sum or md5.

Do not use these to store passwords

MD5 and SHA-1 are broken for security: different inputs with the same hash can be made on purpose. All five algorithms here are also built to be fast, which is exactly wrong for passwords, because it lets an attacker try billions of guesses a second. Store passwords with a slow, salted function such as Argon2, scrypt or bcrypt. Use SHA-256 or SHA-512 for checksums and fingerprints.

At a glance

Algorithms
MD5, SHA-1, SHA-256, SHA-384 and SHA-512, calculated together so you can compare them side by side.
Input
Text, hashed as UTF-8 exactly as typed, or any file. You can hash several files in one go.
Big files
Files over 256 MB are read in 2 MB pieces, so memory use stays small however large the file is. You can cancel any time.
Output
Hex in lower or upper case, or Base64, with a copy button on every line.
Compare
Paste the hash you expect, as hex, Base64 or a whole line from sha256sum, and the page says Match or No match.
How it runs
SHA comes from your browser's Web Crypto when a file fits in memory. MD5 and very large files use code that runs in the page.
Privacy
Your text and files never leave your device.

How to do it

  1. 1

    Choose Text or File

    Type or paste text and the hashes update as you go. For a file, choose it or drop it on the box. Nothing is uploaded.

  2. 2

    Pick the algorithms

    Tap the algorithm names to switch them on or off. Leaving out the ones you do not need makes very large files finish sooner.

  3. 3

    Copy or compare

    Use Copy next to a hash, or paste the hash you were given into Compare with a hash. You see a green Match or a red No match.

Which hash should I use?

A hash turns any amount of data into a short fixed-size fingerprint. The same input always gives the same fingerprint, and a one-bit change gives a completely different one. The five algorithms here differ in length and in how much you can trust them:

  • MD5: 128 bits, 32 hex characters. Broken for security, because different inputs with the same hash can be made on purpose. Still fine for catching accidental damage.
  • SHA-1: 160 bits, 40 hex characters. Also broken for collisions: a practical collision was published in 2017. Avoid it for anything new.
  • SHA-256: 256 bits, 64 hex characters. The sensible default for checksums, fingerprints and cache keys.
  • SHA-384: 384 bits, 96 hex characters. A shortened SHA-512, common in some signing and TLS settings.
  • SHA-512: 512 bits, 128 hex characters. On 64-bit processors it can be faster than SHA-256 for large data.

Hashes are not password storage

A hash is not encryption. You cannot turn it back into the original, but you can guess: an attacker hashes millions of likely inputs and looks for a match. All five algorithms here are designed to be fast, so a modern graphics card can try billions of guesses a second against a leaked list of fast hashes.

Passwords need a function that is slow on purpose and adds a unique random salt per user: Argon2, scrypt or bcrypt. If you only need to fingerprint a file or detect changes, a fast hash like SHA-256 is the right tool. Making a strong password in the first place is a job for the password generator.

Verifying a download

Software sites often publish a checksum next to the download. To check it, hash the file here and paste the published value into Compare with a hash. A match means your copy is bit for bit the same as the file the checksum was made from, so the download was not cut short or damaged.

A checksum from the same page as the download does not prove the file is safe: someone who can replace the file can replace the checksum. It is strongest when the checksum comes from a different, trusted place, or when it is signed. To cross-check on your own machine: sha256sum file on Linux, shasum -a 256 file on macOS, and Get-FileHash file -Algorithm SHA256 in Windows PowerShell.

Why your hash differs from another tool

When two tools disagree about the same text, the input is almost never the same. The usual causes:

  • A trailing newline. In a terminal, echo hello adds a line break and printf hello does not. The hashes of hello and hello plus a newline are completely different. This page adds nothing to what you type.
  • Line endings. Windows uses two characters (CRLF) and Linux and macOS use one (LF). A file saved on one and hashed on another can differ.
  • Text encoding. This page hashes text as UTF-8. Some tools hash UTF-16, which gives a different result for the same words.
  • Invisible characters. A byte order mark, a non-breaking space or a trailing space changes the hash. The byte count shown under the text box helps spot them.

Upper or lower case in the hash itself never matters: ABCD and abcd are the same value written two ways.

Questions people ask

Will the same text always give the same hash?

Yes. A hash function has no randomness, so the same bytes always produce the same result on any device and in any tool. Salts, which are random, are added by password systems on top of a hash and are not part of it.

Can a hash be reversed to get the original text?

Not by calculation. But short or common inputs can be found by hashing guesses until one matches, which is why common passwords hashed with a fast algorithm are easy to recover.

Why is my hash different from echo hello | sha256sum?

The echo command adds a line break to the end of the text, so it hashes six bytes while this page hashes the five you typed. Use printf hello or echo -n hello in the terminal to match.

How big a file can I hash?

The tool sets no size limit. Files up to 256 MB are read at once so your browser can use its built-in SHA code, and larger files are read in 2 MB pieces so memory use stays small. How long it takes depends on your device and on how many algorithms are ticked.

Is MD5 still safe to use?

For spotting accidental corruption, yes. For anything an attacker could tamper with, such as signatures, certificates or password storage, no. Use SHA-256 or SHA-512 instead.

Are my files or text uploaded?

No. Hashing happens in your browser. The file is read from your disk into the page and never sent over the network.

Guides that help

All Data and developer guides →

Data and developer

The download page prints a long string of letters next to the button. Here is how to check it in a minute

5 min readRead

Data and developer

Length beats cleverness: how long a password should be, and the arithmetic that proves it

6 min readRead

Data and developer

Base64 looks like encryption and is not. What it does, why it exists and why your decode fails

6 min readRead

Pairs well with

Password Generator

Make random passwords and passphrases and see how many bits of entropy they have.

Opens Nothing to open · Saves Copied text

Open tool

UUID Generator

Generate version 4 and version 7 UUIDs in bulk, in several formats, and read the time inside one.

Opens Nothing to open · Saves Copied text, TXT

Open tool

Unix Timestamp Converter

Turn a Unix timestamp into a readable date in any time zone, or a date into a timestamp.

Opens Seconds, milliseconds, ISO 8601, RFC 2822 · Saves Copied text

Open tool

Data Converter

Convert CSV, TSV, JSON, XML, YAML and Excel files into each other, with nested data and large files handled.

Opens CSV, TSV, JSON, XML, YAML, XLSX · Saves CSV, TSV, JSON, XML, YAML, XLSX

Open tool