Hash Generator

What a hash is actually doing

Every time you hash something with this tool, you run it through a one-way mathematical function that turns any input — a single character, a whole novel, a 4 GB video file — into an output of a fixed size. Change a single bit of the input and the output changes completely; feed the same input twice and you get the identical output every time. That combination — fixed size, deterministic, unpredictable on change — is what makes hashes useful for two very different jobs: proving a file wasn't corrupted or tampered with (integrity checking and checksums), and, in a far more hardened form, protecting stored passwords. This generator is built for the first job, not the second — more on why below.

Using this generator

1. Text tab — type or paste anything (a config string, a line from a log file, a short message) and all five digests update as you type.
2. File tab — drop a downloaded file (installer, ISO, archive). The browser reads it with FileReader and hashes the raw bytes; nothing is uploaded anywhere.
3. Output case — toggle lowercase/UPPERCASE hex. Some vendors publish checksums in uppercase, some in lowercase; the digest itself never changes, only how it's printed.
4. Verify box — paste the checksum a project published (README, release notes, download page). The matching card lights up green. No match means the file is still downloading, corrupted, or was altered in transit.

How the five algorithms differ

MD5 (1992) produces a 128-bit digest (32 hex characters) over 64 internal rounds; SHA-1 (1995) produces 160 bits (40 hex characters) over 80 rounds. Both compress the input through a Merkle–Damgård construction: the message is padded, split into fixed-size blocks, and each block updates a running internal state. SHA-256, SHA-384 and SHA-512 belong to the newer SHA-2 family — SHA-256 outputs 256 bits (64 hex characters), while SHA-384 and SHA-512 share a larger 512-bit internal state built around 64-bit words, one truncated to 384 bits (96 hex characters) and one left at the full 512 bits (128 hex characters). A longer digest and more mixing rounds mean a dramatically larger search space for anyone trying to engineer two inputs that hash the same.

At a glance

Collisions, and why MD5 / SHA-1 are considered broken

A collision is two different inputs that produce the same digest. Researchers demonstrated a practical MD5 collision in 2004 and a practical SHA-1 collision (the "SHAttered" attack) in 2017 — both were engineered deliberately, not found by accident, and that's exactly the risk: an attacker can craft a malicious file that hashes identically to a legitimate one. That's why MD5 and SHA-1 must never back a digital signature, a TLS certificate, or a software-update mechanism, even though they remain perfectly fine for catching accidental corruption — a truncated download, a bit-flipped copy, a partial upload.

Hashing is not password storage

A raw hash from this tool, using any of the five algorithms shown, is the wrong way to store passwords. SHA-256 is fast by design — which is exactly the problem: a modern GPU can attempt billions of SHA-256 guesses per second against a leaked password list. Real password storage needs a deliberately slow, memory-hard function such as bcrypt, scrypt, or Argon2, combined with a per-user random salt, so that two users who happen to share a password don't get the same stored value and brute-forcing a single guess stays expensive. If a login system stores plain MD5(password), treat it as insecure.

Common mistakes

• Comparing a hash generated from pasted text against a checksum meant for a file's exact bytes — an extra trailing newline from copy-pasting changes the digest entirely.
• Treating uppercase and lowercase hex as "different" hashes — they're the same digest, just printed differently; the case toggle here only changes formatting.
• Hashing a password and storing the result as if it were secure — use a dedicated password hasher (bcrypt/Argon2), not this generator, for anything that authenticates a user.
• Trusting an MD5 or SHA-1 match as proof of authenticity against a determined attacker — fine against accidental corruption, not against someone who deliberately engineered a collision.

What this tool doesn't do

It doesn't compute HMAC (keyed hashes used for message authentication), it doesn't perform password hashing, and it can't reverse a digest back into the original input — hashing is one-way by design. For those needs, reach for a dedicated cryptography library or a password-hashing utility built for that purpose.