### Input Text Sample Live Preview

_Enter text to generate hash..._

Generate  All  Clear

### Generated Hashes Live

Start typing to see live hash generation...

### File Checksum Generator

Choose a file up to 100 MB. Its bytes are processed locally in your browser; the file is not uploaded.

1. Choose the file and select its checksum type.
2. Select Generate File Checksum and wait for the result.
3. Optionally paste the expected checksum below the result to compare it.

Choose file

Checksum type

- SHA-256
- SHA-384
- SHA-512
- SHA-1
- MD5

Generate File Checksum

# Hash Generator: SHA-256, SHA-512 and File Checksums

Generate hashes from text or a file, compare a file checksum, and copy the result. Processing happens locally in your browser.

## What Is a Hash Function? Complete Guide to Cryptographic Hashing

A **cryptographic hash function** is a mathematical algorithm that takes an input of any length and produces a fixed-size output called a **hash**, **digest**, or **checksum**. The same input always produces the same hash, but even a single character change in the input produces a completely different hash - a property called the **avalanche effect**.

Hash functions are **one-way functions**: it is computationally infeasible to reverse a hash to recover the original input. This property distinguishes hashing from encryption (which is reversible with a key) and from encoding like Base64 (which is trivially reversible). Hash functions are a foundational building block of information security, used in digital signatures, data integrity verification, password storage, blockchain, and API authentication.

Use this free text hash generator to compare a known text value with the digest calculated in your browser. Every character matters: a trailing space, line break, or different character encoding changes the bytes and can change the result. The input may be saved in local browser storage, so avoid entering secrets.

### How to Use This Online Hash Generator

This tool is designed for speed and simplicity. Here is how to generate a hash in seconds:

1. Enable **Live Preview** to generate hashes automatically as you type (recommended).
2. Type or paste text into the left input panel. Avoid entering passwords, API keys, or other secrets, especially on shared devices.
3. Select your desired hash algorithm from the dropdown (SHA-256 is recommended for most use cases).
4. The hash updates live in the right panel - or click **Generate** if Live Preview is off.
5. Click **All** to generate the available text results for comparison.
6. Use the **Copy** button next to each hash to copy it to your clipboard.
7. Drag the center divider to resize the input/output panels to your preference.

### Hash Algorithms Explained: MD5, SHA-256, SHA-512 and More

#### MD5 - 128-bit (32 hex chars)

Developed by Ronald Rivest in 1991, MD5 was the dominant hash algorithm for most of the 1990s and 2000s. It produces a 128-bit (32 hexadecimal character) output. **MD5 is cryptographically broken** - collision attacks have been demonstrated, meaning two different inputs can produce the same MD5 hash. It should not be used for security-sensitive applications like password hashing or digital signatures. MD5 remains useful for non-cryptographic purposes like file checksums, deduplication keys, and cache invalidation where collision resistance is not critical.

#### SHA-1 - 160-bit (40 hex chars)

SHA-1 (Secure Hash Algorithm 1) was designed by the NSA and published by NIST in 1995. It produces a 160-bit (40 hex character) digest. SHA-1 was officially broken in 2017 when Google's SHAttered attack demonstrated a practical collision. **SHA-1 should not be used for any security purpose.** Major browsers and certificate authorities have deprecated SHA-1 for TLS certificates. It persists in legacy systems, Git object storage, and some older protocols, but should be migrated to SHA-256 or stronger.

#### SHA-256 - 256-bit (64 hex chars) ✓ Recommended

SHA-256 is part of the SHA-2 family designed by the NSA and published by NIST in 2001. It produces a 256-bit (64 hex character) digest and is currently considered **cryptographically secure with no known practical attacks**. SHA-256 is the most widely deployed cryptographic hash function today, used in TLS/HTTPS certificates, Bitcoin mining (double SHA-256), JWT HMAC-SHA256 signing, code signing, Subresource Integrity (SRI) in browsers, npm package-lock.json integrity fields, and AWS Signature Version 4. For any new development, SHA-256 is the recommended default.

#### SHA-512 - 512-bit (128 hex chars)

SHA-512 produces a 512-bit (128 hex character) digest. It is useful when a format or application requires that digest; SHA-256 and SHA-512 have different outputs and are not interchangeable. Performance depends on the device and implementation.

#### SHA-384 - 384-bit (96 hex chars)

SHA-384 produces a 384-bit (96 hex character) digest. It uses a SHA-512-family construction with a distinct initialization and truncated output, so its result is not simply the first 96 characters of a SHA-512 digest. Select the exact algorithm specified by the source you are checking.

#### CRC32 - 32-bit checksum (8 hex chars)

CRC32 (Cyclic Redundancy Check) is not a cryptographic hash - it is a checksum algorithm designed for error detection in digital networks and storage. It produces a 32-bit (8 hex character) output and is extremely fast. CRC32 is used in ZIP file compression, PNG image format, Ethernet and other network protocols, and zlib compression. It is not suitable for any security purpose because collisions can be engineered intentionally. Use CRC32 only for accidental error detection.

#### Adler32 - 32-bit checksum

Adler32 is a checksum algorithm developed by Mark Adler as part of the zlib compression library. It is faster but slightly less reliable than CRC32 for detecting errors. Adler32 is used in the zlib format (gzip, deflate compression) and the PNG image standard. Like CRC32, it is not cryptographically secure and should only be used for non-security checksum purposes.

#### FNV-1a - 32-bit non-cryptographic hash

FNV-1a (Fowler–Noll–Vo) is a popular non-cryptographic hash function known for its speed and good distribution properties. It is widely used in hash tables, databases, programming language runtimes, and data structures where speed matters more than collision resistance. FNV-1a is not suitable for security applications. Our implementation uses the 32-bit variant.

### Real-World Use Cases for Hash Functions

#### File Integrity Verification

Some software publishers provide a SHA-256 checksum alongside a download. Select the downloaded file in the File Checksum Generator and compare its result against a checksum obtained from a trusted publisher. A match alone does not establish authenticity if the checksum itself came from an untrusted source.

#### API Webhook Signatures (HMAC)

Some services use a keyed message authentication code to sign webhook payloads. Verifying one requires the correct secret, the exact request bytes and the service's verification procedure. This tool generates plain hashes and does not generate or verify HMAC signatures.

#### Subresource Integrity (SRI)

Subresource Integrity lets a browser check a script or stylesheet against a digest specified by its publisher. It requires a digest of the exact resource bytes in the expected encoding. This tool outputs hexadecimal values and is not an SRI generator.

#### Content Deduplication

Hashes can help compare content fingerprints. Select the original file for a file checksum; do not paste its displayed contents and assume the result matches its original bytes.

#### Data Fingerprinting and ETags

HTTP ETags use hashes of resource content to enable conditional requests. When content changes, the hash changes, and the browser knows to fetch a fresh copy. Hash-based ETags are also used for cache invalidation in CDNs, API versioning, and optimistic concurrency control in databases.

#### Password Hashing (Properly)

Plain SHA-256 is **not suitable for password storage** because it is too fast - attackers can compute billions of SHA-256 hashes per second to crack passwords via rainbow tables or brute force. For passwords, use slow adaptive hash functions: **Argon2id** (modern best practice), **bcrypt**, or **scrypt**, all of which include a random salt and adjustable work factor to resist attacks.

### How to Verify a File Checksum

A checksum gives you a practical way to check that a downloaded or transferred file matches a known copy. For example, a software publisher may list a SHA-256 value beside a download. After saving the file, select it in the file checksum section above, choose SHA-256, and generate its checksum. Paste the publisher's value into the comparison field to check whether the two match.

Make sure the published value belongs to the exact file and release you downloaded. Different versions, operating-system packages, and archives normally have different checksums. A filename can stay the same while its contents change, so compare the complete checksum rather than only its first few characters. Uppercase and lowercase hexadecimal letters represent the same value.

If the values differ, check that you selected the correct checksum type and the correct download. Download the file again if it may have been interrupted or modified, and obtain the expected value from a trusted publisher. A matching checksum supports an integrity check against that reference; it does not prove who published the file if the reference itself is untrusted.

The file tool reads the selected file locally and accepts files up to 100 MB. Larger files and devices with limited memory may need a desktop checksum utility. Your original file is not changed by calculating its checksum.

### Text Hash Examples and Troubleshooting

To try a repeatable example, enter `abc` with no spaces or line break and select SHA-256. The result is `ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad`. Add a space after the final letter and generate the hash again: the visible text is almost the same, but the input bytes and resulting digest are different.

When two text hashes do not match, compare capitalization, spaces, punctuation, and line endings first. A file may contain a final newline even when its text looks identical in an editor. Text entered here is encoded as UTF-8; a file checksum uses the selected file's actual bytes, which may use a different encoding or contain additional bytes.

For JSON, the order and spacing in the original text matter to its hash. The [JSON Formatter](https://www.toolcomb.com/json-formatter) can make a document easier to inspect, and [JSON Compare](https://www.toolcomb.com/json-compare) can help you examine differences. Formatting changes the text, however, so hash the original bytes when checking a publisher's checksum.

Need a reversible representation instead of a fingerprint? The [Base64 Encoder and Decoder](https://www.toolcomb.com/base64-encoder) converts text to and from Base64; it does not encrypt it. For creating a new password, use the [Password Generator](https://www.toolcomb.com/password-generator) instead of treating a plain hash as a password-storage method.

### Hashing vs Encryption vs Encoding - Key Differences

| Property | Hashing | Encryption | Encoding (Base64) |
| --- | --- | --- | --- |
| Reversible? | No | Yes (with key) | Yes (trivially) |
| Requires key? | No | Yes | No |
| Fixed output size? | Yes | Variable | ~33% larger |
| Purpose | Integrity | Confidentiality | Compatibility |
| Security | High (SHA-256+) | High (AES-256) | None |
| Examples | SHA-256, bcrypt | AES-GCM, RSA | Base64, URL enc |

### Code Examples: Generate SHA-256 and MD5 Hashes

#### JavaScript (Browser - Web Crypto API)

```
async function sha256(text) {
const encoder = new TextEncoder();
const data = encoder.encode(text);
const hashBuffer = await crypto.subtle.digest("SHA-256", data);
return Array.from(new Uint8Array(hashBuffer))
.map(b => b.toString(16).padStart(2, "0"))
.join("");
}

const hash = await sha256("Hello, World!");
// a591a6d40bf420404a011733cfb7b190...
```

#### Python - hashlib

```
import hashlib

# SHA-256
sha256_hash = hashlib.sha256(
"Hello, World!".encode("utf-8")
).hexdigest()

# MD5 (not for security)
md5_hash = hashlib.md5(
"Hello, World!".encode("utf-8")
).hexdigest()
```

#### Node.js - crypto module

```
const crypto = require("crypto");

const sha256 = crypto
.createHash("sha256")
.update("Hello, World!", "utf8")
.digest("hex");

const md5 = crypto
.createHash("md5")
.update("Hello, World!", "utf8")
.digest("hex");
```

#### PHP

```
// SHA-256
$sha256 = hash("sha256", "Hello, World!");

// MD5
$md5 = md5("Hello, World!");

// SHA-512
$sha512 = hash("sha512", "Hello, World!");
```

### Frequently Asked Questions About Hash Generation

#### Which hash should I use to check a file?

Use the algorithm specified alongside the trusted checksum. SHA-256 is a common choice for file integrity. A matching checksum is only as trustworthy as its source. Plain hashes are not suitable for password storage.

#### Can a hash be reversed or cracked?

Cryptographic hash functions are one-way - you cannot mathematically reverse a hash to recover the original input. However, common strings may appear in precomputed **rainbow tables**. For example, the MD5 hash of "password" is well-known and indexed. This is why password storage must use unique per-user salts combined with slow hash functions (bcrypt, Argon2id) that make precomputed table attacks infeasible.

#### Why does the same text always produce the same hash?

Hash functions are **deterministic** - identical inputs always produce identical outputs. This is by design: it enables you to verify data integrity by recomputing the hash and comparing. The SHA-256 hash of "Hello, World!" will always be `a591a6d40bf420404a011733cfb7b190...` on any computer, in any programming language, at any time.

#### What is a hash collision?

A collision occurs when two different inputs produce the same hash output. For MD5 and SHA-1, collisions have been demonstrated with practical attacks (Flame malware used an MD5 collision in 2012; Google's SHAttered demonstrated a SHA-1 collision in 2017). SHA-256 has no known practical collisions - the 2^128 operations required for a collision are computationally infeasible with current and foreseeable technology.

#### How do I verify a file download using SHA-256?

After downloading a file, select it in the File Checksum Generator, choose SHA-256, and compare the result to the checksum obtained from a trusted publisher. Matching hashes provide an integrity check, but authenticity also depends on trusting the published checksum.

#### Is my data secure when using this hash tool?

Hashing runs in your browser. Entered text is saved in local browser storage and can be restored for up to 30 days; older saved input is removed when the page is revisited. Use Clear when finished, and consider the security of the device and browser extensions.

#### What is HMAC and how does it differ from a plain hash?

HMAC combines a hash function with a secret key to produce an authentication code. A plain hash has no secret key. This tool calculates plain hashes and checksums; it does not generate or verify HMAC.

## Related Tools

Discover more free tools that might help with your next task.

[Base64 Encoder Encode and decode Base64 data Use Tool](https://www.toolcomb.com/base64-encoder)

[URL Decoder Decode URL-encoded strings Use Tool](https://www.toolcomb.com/url-decoder)

[HTML Encoder Encode and decode HTML entities Use Tool](https://www.toolcomb.com/html-encoder)

[UUID Generator Generate v1, v3, v4, and v5 UUIDs Use Tool](https://www.toolcomb.com/uuid-generator)

[Password Generator Generate secure random passwords Use Tool](https://www.toolcomb.com/password-generator)

[JWT Decoder Inspect JWT headers and payloads without verifying signatures Use Tool](https://www.toolcomb.com/jwt-decoder)

### Related guides

Read the how-to, then come back to this tool when you are ready to run it locally.

- [Base64 Is Not Encryption: Encoding vs Secrets Base64 hides nothing. Why people treat it like a cipher, what it is actually for (data URLs, JWTs, APIs), and how to encode or decode in the browser without uploading a key.](https://www.toolcomb.com/blog/base64-is-not-encryption)
- [What Not to Paste Into Online Developer Tools JWTs, API keys, customer JSON, and password checkers: a practical list of what to keep off random websites, and which jobs can stay in the browser.](https://www.toolcomb.com/blog/what-not-to-paste-into-online-developer-tools)
- [MD5 vs SHA-1 vs SHA-256: What Hashes Are For Hashing vs encryption, collisions, and local checksums.](https://www.toolcomb.com/blog/md5-vs-sha1-vs-sha256-what-hashes-are-for)

[View All Tools](https://www.toolcomb.com/tools)