🔑 Checksum & Hash Generator

Get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of a piece of text or a whole file, side by side, without uploading it. Checksums are how you prove a download is the file the publisher intended: if one bit changed in transit, every digit above changes. That is also why a hash is not a secret — anything you hash is still in your hands.

Click any digest to copy it. Digests are hexadecimal, lowercase, no spaces — the form checksum files and package registries print.

Which one should you send?

SHA-256 is the default answer for anything new: it is what package managers, Git object names, TLS certificates and “verify your download” pages use. SHA-512 is the same family with a bigger internal state and is standard on 64-bit systems; neither is “more secure” in any way that matters to a person checking a download. SHA-1 is fine as a change detector and dead as a security claim — the SHAttered collision in 2017 produced two different PDFs with the same SHA-1, and chosen-prefix collisions followed. MD5 is worse: collisions are trivial to generate, so never use it to prove authenticity — but it is still everywhere as a fast file fingerprint (ETags, dedupe, old drivers, ROM databases), which is why it is here, labelled.

A hash proves integrity, not identity. If an attacker controls both the file and the published hash, the match proves nothing; the hash has to come from somewhere you trust independently — the vendor’s HTTPS page, a signed release note. Hashes are also not encryption: you cannot reverse them, and a short password hashed with any of these can still be guessed offline at billions of attempts per second. For passwords, use a slow salted function (argon2, bcrypt, scrypt), never a general-purpose digest. Everything here runs locally; there is no upload, and no server ever sees your bytes.

Part of Everyday Tools. Encoding rather than hashing? Base64 & data URLs is the reversible one.