What a hash is
A cryptographic hash function takes input of any size and produces a fixed-size output, usually shown in hexadecimal. Good hash functions have three key properties:
- Deterministic: the same input always gives the same hash.
- Avalanche effect: a tiny change (one letter, one bit) gives a completely different hash.
- One-way: you can't work backwards from a hash to the original input, and it's infeasible to find two inputs with the same hash.
Which algorithm?
| Algorithm | Length | Status |
|---|---|---|
| MD5 | 128 bits (32 hex) | Broken for security: collisions are easy to create. Fine for spotting accidental corruption. |
| SHA-1 | 160 bits (40 hex) | Broken for security since 2017. Still used by Git for object IDs. |
| SHA-256 | 256 bits (64 hex) | Secure. The standard choice for checksums, certificates and blockchains. |
| SHA-384 | 384 bits (96 hex) | Secure; a shortened SHA-512. |
| SHA-512 | 512 bits (128 hex) | Secure, and often faster than SHA-256 on 64-bit computers. |
Verifying a download
- On the download page, find the checksum (often labelled SHA-256, SHA256SUMS or "checksum").
- Choose File above and select the downloaded file.
- Paste the checksum into Expected hash. A green "Match" means the file is exactly the one the publisher released, not damaged in transfer or swapped.
The same check from a terminal:
Hashing text
Text is converted to bytes using UTF-8 before hashing, the same as most programming languages and command-line tools. Hidden differences such as a trailing space or newline change the hash, so if your result doesn't match another tool's, check for those. For example, echo "hello world" | sha256sum includes a newline; printf "hello world" doesn't.
Don't store passwords with these hashes
MD5 and SHA hashes are designed to be fast, which makes them unsuitable for passwords: attackers can try billions of guesses per second. Use a dedicated password hashing function such as Argon2, bcrypt or scrypt, which are slow on purpose and add a unique salt to each password.
Everything is computed in your browser with the built-in Web Crypto API (and the CryptoJS library for MD5). Your text and files never leave your device.
Frequently asked questions
How do I get the SHA-256 hash of a file?
Choose File, then select the file. Its SHA-256 hash appears along with MD5, SHA-1, SHA-384 and SHA-512.
How do I verify a checksum?
Select the file and paste the published checksum into Expected hash. The tool tells you whether it matches.
Is MD5 still safe?
Not for security, because collisions can be created on purpose. It is still fine for detecting accidental corruption.
Can a hash be reversed?
No. Hashes are one-way. Short or common inputs can sometimes be guessed by trying many possibilities, which is why passwords need special slow hashes.
Are my files uploaded?
No. Hashes are calculated in your browser, so files never leave your device.
Last updated October 2026 · More developer tools