Generate MD5, SHA-256, SHA-512, SHA-3 and BLAKE3 hashes instantly. Hash text and files, verify integrity, compare and auto-detect digests, and run HMAC — across 23 algorithms, entirely in your browser. No upload, no sign-up.
Generate MD5, SHA-1, SHA-256, SHA-512, the full SHA-3 family, BLAKE2, BLAKE3, RIPEMD-160, Whirlpool, HMAC and CRC/Adler checksums from text or files — with live generation, verification, comparison, auto-detection, batch processing and a developer API. Every algorithm is a correct, test-vector-verified implementation, and nothing you enter ever leaves your device.
Hash text with 23 algorithms at once — MD5, SHA-1/2/3, BLAKE2/3, RIPEMD, Whirlpool and checksums — updating as you type.
File & bulk hashing
Drag in any file (or many) and hash them locally in streamed chunks — no size limit and nothing leaves your device.
Integrity verification
Paste a published checksum to instantly confirm a download is authentic, complete and untampered.
Compare & validate
Diff two hashes character-by-character, or validate that data matches an expected hash with auto-detected algorithm.
Auto hash detector
Paste any unknown hash and identify the likely algorithm from its length, with confidence scoring.
HMAC generator
Compute keyed HMAC-MD5/SHA-1/SHA-256/SHA-512/SHA-3 for API signing and message authentication.
Security analyzer
See each algorithm rated Deprecated → Modern, benchmark throughput on your device, and get a recommendation.
Developer ready
Batch hashing, a live API playground and copy-paste code in 15 languages — from JavaScript to Rust.
How to generate a hash
1
Pick your algorithms
Choose one or many — SHA-256 is the safe default; add MD5, SHA-512, SHA-3 or BLAKE3 as needed.
2
Enter text or a file
Type/paste text for live hashing, or drag a file in to hash it locally in chunks.
3
Read the digests
Copy any hash, change the output format (hex, Base64, binary), or export all results.
4
Verify or compare
Paste an expected checksum to confirm integrity, or compare two hashes to spot differences.
Hash education center
What is a hash?
A hash is the fixed-size output of a hash function — a mathematical procedure that takes any input, of any length, and produces a short, fixed-length “fingerprint” of it. Hash the word “hello” with SHA-256 and you always get the same 64-character hexadecimal digest; change a single letter and the output changes completely.
Cryptographic hash functions have three defining properties: they are deterministic (same input → same output), they are one-way (you cannot reverse a digest back to the input), and they are collision-resistant (it is infeasible to find two inputs with the same digest). These make hashes ideal for verifying integrity, fingerprinting data and building higher-level security protocols.
How hash functions work
Most classic hashes (MD5, SHA-1, SHA-2) use the Merkle–Damgård construction: the message is padded, split into fixed-size blocks, and each block is mixed into an internal state by a compression function. After the final block, the state becomes the digest. SHA-3 instead uses a “sponge” construction (Keccak) that absorbs input then squeezes output, and BLAKE3 uses a binary tree of compressions so it can hash in parallel.
A good hash exhibits the avalanche effect — flipping one input bit flips about half the output bits — so similar inputs produce wildly different digests. This unpredictability, combined with a large output space, is what makes collisions and reversals computationally infeasible for secure algorithms.
Hashing vs encryption
Encryption is reversible: with the right key, ciphertext turns back into the original data. Hashing is one-way: there is no key and no way to recover the input from a digest. You encrypt data you need to read back later (like messages or files); you hash data you only need to verify (like passwords or downloads).
A useful rule of thumb: if a process can be undone with a secret, it’s encryption. If it can only ever be checked by repeating it, it’s hashing.
Hashing vs encoding
Encoding (like Base64 or URL-encoding) simply represents data in a different alphabet so it can travel safely through a channel. It is fully reversible and provides no security — anyone can decode Base64 instantly. Hashing is one-way and is about integrity and fingerprinting, not transport. Never treat Base64 as “encryption”.
Hashing vs checksum
A checksum (CRC-32, Adler-32) is a small, fast value designed to catch accidental corruption — a flipped bit during a download or a bad disk sector. It is excellent at that job and terrible at security: an attacker can trivially modify data and fix the checksum to match. A cryptographic hash (SHA-256, BLAKE3) is collision-resistant, so it detects deliberate tampering as well as accidental damage. Use checksums for error detection, cryptographic hashes for security.
Collision resistance & one-way functions
Collision resistance means it’s infeasible to find two different inputs that hash to the same value. MD5 and SHA-1 have failed this — researchers can now manufacture collisions on demand (MD5 in seconds, SHA-1 since the 2017 “SHAttered” attack), which is why both are unsafe for signatures and certificates.
A one-way (preimage-resistant) function means that given a digest, you cannot find an input that produces it short of brute force. This is the property that makes hashing safe for fingerprinting — even if an attacker sees the hash, they learn nothing about the data.
File integrity & software verification
When you download software, the publisher often lists a SHA-256 checksum next to the file. After downloading, you hash your copy and compare: if the digests match, the file is bit-for-bit identical to what the publisher released; if they differ, the download is corrupted or has been tampered with. This single check defends against truncated downloads, disk errors and man-in-the-middle attacks. This tool’s File tab does exactly this — locally, with no upload.
Password hashing — use the right tool
It is a common and dangerous mistake to store passwords as MD5 or even SHA-256. General-purpose hashes are built to be fast, so an attacker who steals your database can try billions of guesses per second on a GPU. Passwords need a deliberately slow, salted, memory-hard function: Argon2id (the modern first choice), bcrypt, scrypt or PBKDF2.
Use SHA-256 and friends for integrity, signatures and fingerprinting — and a dedicated password KDF for credentials. Our Bcrypt & Password Hashing toolkit covers the password side.
Algorithm comparison tables
Head-to-head comparisons to help you pick the right algorithm for the job.
MD5 vs SHA-256
MD5
SHA-256
Output
128-bit
256-bit
Security
Broken (collisions trivial)
Very strong
Speed
Very fast
Fast
Safe for signatures
No
Yes
Use today
Non-security checksums only
Default for integrity & signatures
SHA-256 vs SHA-512
SHA-256
SHA-512
Output
256-bit
512-bit
Internal words
32-bit
64-bit
Speed on 64-bit CPUs
Fast
Often faster
Security margin
Very strong
Even higher
Best for
General use, smaller digests
Max margin; SHA-512/256 avoids length-extension
SHA-2 vs SHA-3
SHA-2
SHA-3
Design
Merkle–Damgård
Keccak sponge
Year
2001
2015
Length-extension
Vulnerable (256/512)
Immune
Speed (software)
Faster
Moderate
Role
Workhorse standard
Different-design backup / future-proofing
SHA-256 vs BLAKE3
SHA-256
BLAKE3
Year
2001
2020
Speed
Fast
Extremely fast (parallel tree)
Keyed mode / XOF
Needs HMAC
Built-in keyed mode + XOF
Adoption
Universal
Growing
Best for
Maximum interoperability
High-performance hashing of big data
CRC-32 vs SHA-256
CRC-32
SHA-256
Type
Checksum
Cryptographic hash
Output
32-bit
256-bit
Detects accidental errors
Yes
Yes
Detects tampering
No
Yes
Use
ZIP/PNG/Ethernet integrity
Security-grade integrity
SHA-256 vs Whirlpool
SHA-256
Whirlpool
Output
256-bit
512-bit
Design basis
SHA-2 family
AES-like (ISO standard)
Speed
Fast
Slower
Adoption
Universal
Niche / archival
Best for
Everyday integrity
Large-digest archival integrity
What are hashes used for?
Software downloads
Confirm an installer or ISO matches the publisher’s SHA-256 checksum before you run it.
File integrity
Detect corruption or tampering in backups, transfers and archives by comparing hashes over time.
API authentication
Sign and verify webhook payloads and API requests with HMAC-SHA256.
Blockchain & Git
Understand the SHA-256 (Bitcoin) and SHA-1/SHA-256 (Git) hashes that identify blocks and commits.
Digital forensics
Fingerprint evidence files so any later change is provable — a cornerstone of chain-of-custody.
Malware analysis
Compute a sample’s hash to look it up in threat-intel databases like VirusTotal.
Pro tips
Use SHA-256 as your default for integrity and signatures — it’s fast, universal and unbroken.
Never use MD5 or SHA-1 for security: both have practical collision attacks. Keep them only for non-security checksums and legacy interop.
A hash mismatch on a download means stop — the file is corrupted, incomplete, or tampered with.
Hashing is one-way: a “hash decrypter” only looks up or brute-forces common inputs, it cannot reverse the maths.
For passwords, never use a plain hash — use Argon2id, bcrypt, scrypt or PBKDF2 (see our Bcrypt tool).
BLAKE3 is the fastest secure option here and is ideal for hashing very large files.
Use HMAC (not a bare hash of key+message) whenever you need keyed authentication — it resists length-extension attacks.
CRC-32 and Adler-32 detect accidental corruption cheaply but provide zero protection against deliberate tampering.
Hashing glossary
Hash function
A one-way function mapping any input to a fixed-size digest that can’t be reversed.
Digest
The fixed-length output of a hash function (e.g. 256 bits for SHA-256).
Checksum
A short value used to detect accidental data corruption (e.g. CRC-32) — not secure against attacks.
Collision
Two different inputs producing the same hash. Secure hashes make these infeasible to find.
HMAC
Hash-based Message Authentication Code — a keyed hash proving authenticity and integrity.
Salt
Random data added before hashing (mainly for passwords) so equal inputs hash differently.
Length extension
An attack on MD5/SHA-1/SHA-2 where an attacker appends data to a hashed message; SHA-3/HMAC are immune.
Avalanche effect
A property where flipping one input bit changes ~half the output bits.
Preimage resistance
The difficulty of finding any input that hashes to a given digest.
XOF
Extendable-output function — a hash (like BLAKE3/SHAKE) that can emit any output length.
Frequently asked questions
Hashing runs data through a one-way function to produce a fixed-size “fingerprint” called a digest. The same input always gives the same digest, but you cannot reverse a digest back to the input. Hashing is used for integrity checks, fingerprinting and security protocols.