Hash Generator

Hash Generator - MD5, SHA-1, SHA-256 and SHA-512 Online

Updated September 29, 2026 · By Saman

Paste any text or drop in a file, and this free hash generator produces the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests at the same time, so you can compare them side by side instead of running five separate tools. A separate bcrypt tab makes and checks password hashes. Everything is computed in your browser, which means even a large file stays on your machine.

A hash is a fixed-length fingerprint of your data. Change a single character - even a trailing space - and the output changes completely. That property is what makes hashes useful for verifying downloads, detecting duplicates, building cache keys and comparing two versions of a document without reading either one.

What is a hash function?

A cryptographic hash function takes input of any length and returns a fixed number of bits: 128 for MD5, 160 for SHA-1, 256 for SHA-256 and 512 for SHA-512, usually shown as hexadecimal. The same input always produces the same digest, different inputs practically never collide in a strong algorithm, and there is no way to run the process backwards. That last point is the one people most often get wrong.

Which hash algorithm should you use?

How to generate a hash online

1. Pick the Text tab to hash typed input, the File tab to hash a file, or the bcrypt tab for a password hash.
2. Paste your text, or drag a file onto the upload area - a file starts hashing as soon as you choose it.
3. Click Generate Hashes to compute every digest at once.
4. Copy the digest you need with the button beside it.
5. To check a download, paste the published value into Verify against a published checksum and the tool names the algorithm that matches.

How to check the MD5 or SHA-256 checksum of a file

This is what most people actually came for. Open the File tab, drop in the installer, archive or ISO you downloaded, and all five digests are computed from the file bytes exactly as they sit on disk. Paste the checksum printed on the download page into the verify field: a green line naming the algorithm means the file arrived intact, while no match means it was corrupted or tampered with. Files up to 50 MB are supported, and the file is read locally - it is never uploaded.

What people actually use hashes for

• Verifying that an ISO, an installer or a release archive downloaded without corruption or tampering.
• Detecting duplicate records, images or uploads without comparing the full content.
• Building cache keys and ETags from a request or a rendered page.
• Signing API requests, where the client and server hash the same payload and compare results.
• Storing an integrity value in a database so later modification becomes visible.
• Git internals, deduplicating backups and content-addressed storage.

You cannot decrypt a hash

Searches for "MD5 decrypt" are extremely common, and the premise is wrong: hashing is not encryption and there is no key that reverses it. What so-called decrypt sites really do is look the digest up in a huge precomputed table of common inputs. That works for 123456 or password and fails for anything unusual. If you need a reversible transformation, you want encryption or the Base64 encoder instead.

Do not store passwords as MD5 or SHA-256

General-purpose hashes are designed to be fast, and speed is exactly what an attacker with a stolen database wants: modern hardware tries billions of guesses per second. Passwords need a deliberately slow algorithm with a per-user salt - bcrypt, scrypt or Argon2. Use the Text and File tabs for checksums and fingerprints, and let your framework handle password storage.

Generate and check a bcrypt hash

The bcrypt tab is for the times you need a password hash by hand: seeding an admin account, writing a test fixture, or checking why a login fails. Type the password, choose a Cost from 4 to 14 and a Prefix, and click Generate Hashes. Each step up in cost doubles the work; 10 is PHP's default and 12 is a common choice for new systems. $2y$ is what PHP's password_hash() writes, $2b$ is the modern standard elsewhere, and $2a$ is the older label - the three run the same algorithm, so any of them verifies with a matching library. A new random salt is drawn every time, which is why the same password never gives the same hash twice.

To test a password against a stored value, paste the hash into Check a password against a bcrypt hash and click Check. bcrypt only reads the first 72 bytes of a password, and the tool warns you when the input is longer. The bcrypt generator page opens this tab directly.

Tips that avoid confusing results

• A trailing newline or space changes the digest completely. Trim your input before comparing.
• Hashes are case-insensitive in hex form: A3F and a3f are the same value shown differently.
• Text is hashed as UTF-8 bytes, so the same characters in another encoding produce a different digest.
• Checksums published by a project are of the file bytes, not of a text field - use the File tab so the exact bytes are hashed.
• If two different inputs give the same short digest, you have found a collision, which is exactly why MD5 and SHA-1 were retired.

Nothing is uploaded

All five digests are computed client-side in JavaScript. Neither your text nor the file you pick ever reaches a server, so it is safe to fingerprint internal documents, configuration values or customer records while you work.

Get a file's MD5 or SHA-256 hash on Windows, Linux and macOS

The result is the same everywhere: a hash depends only on the bytes, never on the tool that computed it. That is what lets you check a download here against a value the publisher produced on a completely different machine.

Related tools

Fingerprints often sit next to other conversions. Encode binary safely with the Base64 encoder, inspect a signed token with the JWT decoder, generate unique identifiers with the UUID generator, and create strong secrets with the password generator.