Verifying downloads
Check an installer or ISO matches the vendor's published SHA-256.
Hash Generator
Check a download or hash a string. Text and files never leave your device.
Your files stay with you. Your files never leave your browser. This tool runs on your device: nothing is uploaded to our servers, so there is nothing for us to store or see.
How to use it
- Type text, or choose a file.
- Read the five hashes, copy the one you need.
- Paste a published hash into the compare box to check for a match.
Where it helps
Development
Hash a string to compare with a value your code produces.
Spotting changes
Confirm two copies of a document are identical.
Good to know
Stays in your browser
Your text and files are processed on your device and never sent to our servers.
Use SHA-256 or SHA-512
MD5 and SHA-1 only catch accidental changes.
Not for passwords
Store passwords with bcrypt, scrypt or Argon2.
Questions people ask
How do you get the MD5 or SHA-256 hash of text or a file?
Type text or choose a file, and the tool shows its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes at once, each with a Copy button. Paste a checksum published by a vendor into the compare box to check for a match. Files up to about 300 MB are hashed in your browser and never uploaded.
- 5 Hashes at once. MD5 to SHA-512.
- ~300 MB File size. Read in memory.
- Compare Checksum match. Paste and check.
- 0 Uploads. Web Crypto, locally.
How do I verify a downloaded file?
Choose the file here, then paste the checksum published by the vendor into the compare box. A match means your copy is identical, byte for byte, to the one the vendor published. Use the SHA-256 value if the vendor gives one, because it's far stronger than MD5 or SHA-1 against tampering.
Which hash should I use?
SHA-256 or SHA-512 for anything that matters, such as checking downloads or signing data. MD5 and SHA-1 are broken against deliberate attacks, so someone can craft two files with the same hash. They're still fine for spotting accidental changes, such as a corrupted copy or a file that didn't fully transfer.
Can I use these hashes to store passwords?
No. These are fast hashes, which attackers can try billions of times a second on a stolen database. Store passwords on your server with a slow, salted algorithm designed for the job, such as bcrypt, scrypt or Argon2, which most web frameworks include. Never store plain or fast-hashed passwords.
How big a file can I hash?
Up to about 300 MB, because the whole file is read into your browser's memory. SHA hashes use the browser's built-in Web Crypto, and MD5 uses a small built-in implementation. For larger files, such as big disk images, use the sha256sum or certutil command on your own computer.
Is my file uploaded?
No. The file is read and hashed inside your browser, and nothing is sent to our servers or stored. That makes it safe for private documents and software builds. You can disconnect from the internet after the page loads, and hashing will still work exactly the same way.
What is a hash?
A hash is a fixed-length fingerprint of data. The same input always gives the same hash, and changing even one character gives a completely different one. You can't reverse a hash to get the original data, which is why hashes are used to check files and data without revealing the content.
Why does my hash differ from another tool's?
Usually the input differs slightly: a trailing space, a line break, or a different text encoding. This tool hashes text as UTF-8 exactly as typed. Check for hidden whitespace, and make sure both tools use the same algorithm. Case doesn't matter when comparing hexadecimal hashes.
Can I see hashes in uppercase?
Yes. Tick 'Show in UPPERCASE' and every hash is shown in capital letters, which some vendors and Windows tools use. Hexadecimal hashes mean the same in either case, and the compare box matches regardless of case. Choose the style your other tools or documentation already use.
Can I reverse an MD5 hash?
No. Hashes are one-way. Websites that claim to 'decrypt' MD5 just look up hashes of common words and passwords in huge tables. That's exactly why short or common passwords are unsafe even when hashed. Long, random passwords can't be found that way. Use a password generator for that.
How does the compare box work?
Paste a hash you were given into the box. The tool checks it against all five hashes it calculated and tells you which one matches, such as SHA-256, or that none match. That saves you comparing 64 characters by eye, which is slow and easy to get wrong.
Is SHA-1 still safe for Git?
Git originally used SHA-1 to name commits and has added protections and a SHA-256 mode. For your own integrity checks, prefer SHA-256. SHA-1 is still good enough to spot accidental corruption, but not to protect against someone deliberately crafting a matching file. Git's own tools handle this.
Can I hash text in Hindi or other languages?
Yes. Text is converted to UTF-8 bytes before hashing, so any language and emoji work. The same text will always give the same hash. Be careful with characters that look alike but are different, because they produce entirely different hashes. Copy text exactly rather than retyping it, since a single changed letter alters the hash.
What is HMAC, and does the tool do it?
HMAC combines a hash with a secret key to prove a message came from someone who knows the key. Webhooks from payment gateways and WhatsApp often use it. This tool makes plain hashes only, so compute HMAC signatures in your server code, where the secret key stays safe.
Does it work on a phone?
Yes. Type text or pick a file from your phone and the hashes appear with Copy buttons. Large files take longer and use more memory on a phone, so keep to smaller files there. Everything runs inside the mobile browser, with no app and no upload.
Is the hash generator free?
Yes. It's free with no sign-up and no limit on use. It's one of the free developer tools from Marketiism, along with the password and UUID generators. Marketiism builds software that runs WhatsApp, billing and a CRM for small businesses. Use it as often as you need.
Want this inside your own account?
Marketiism keeps your invoice numbers, GST reports, UPI payment links and WhatsApp reminders in one place. Leave your details and we'll call to set it up for your business, or start the trial yourself.
More Developer tools
Base64 Encode and Decode
Encode text to Base64 or decode Base64 back to text, with URL-safe mode.
Strong Password Generator
Create strong random passwords with a strength meter. Nothing is stored or sent.
UUID Generator
Generate random UUID v4 values in bulk, in several formats.
JSON Formatter
Format, validate and minify JSON, and see exactly which line has a mistake.
JSON to CSV
Turn a JSON list of records into CSV for Excel or Google Sheets.
CSV to JSON
Convert CSV rows into a JSON list, with numbers and true/false detected.