Hash Generator

Hash Generator

Updated August 27, 2026

SHA-512 is not password storage. MD5 is not integrity.

SHA-512 is not password storage. MD5 is not integrity. A hex digest is a fingerprint of bytes, not a lock, and treating it as either is how leaks happen.

Paste the text (or pick a file). Read the algorithm name before you copy the hex. If this is a password, stop and use Argon2 or bcrypt instead.

How to use it

  1. Checksums for “did the download match”: SHA-256 or SHA-512. Compare against the vendor’s published digest on /hash/compare.
  2. MD5 and SHA-1 are broken for anything adversarial. They still catch accidental bit flips. They do not stop someone who wanted a collision.
  3. Same bytes, same digest, always. One flipped bit, a different digest. If two files match on SHA-256, they are the same bytes.
  4. Hex vs Base64 is encoding of the digest, not a different hash. Don’t mix them in a compare.

When it breaks

  • Do not hash passwords with SHA-256 or SHA-512, “even with a salt you invented.” Use a password hash (Argon2, bcrypt, scrypt). Fast hashes are a feature for checksums and a bug for passwords.
  • HMAC is not this page. If you needed a signature with a secret, you needed HMAC, not a raw digest.
  • File hashing should not freeze the tab. If it does, the work is still on the main thread; that’s a bug in the tool, not in your file.
0 chars

About Hash Functions

  • • MD5 (128-bit) - Fast checksum, not for security. Collisions possible.
  • • SHA-1 (160-bit) - Used in Git. Deprecated for security.
  • • SHA-256 (256-bit) - Industry standard. Bitcoin, TLS, file verification.
  • • SHA-512 (512-bit) - Longer SHA-2 digest than SHA-256. Still not for storing passwords.
  • • CRC32 (32-bit) - Fast error detection, not cryptographic.

Features

  • MD5, SHA-1, SHA-256, SHA-512, CRC32 side by side so lengths differ on purpose
  • File digest for checksum comparison against a published SHA-256
  • Will not store a password; these functions are not bcrypt/Argon2
  • Hex and Base64 views of the same digest

Common Use Cases

  • Match a downloaded ISO against a published SHA-256
  • See that MD5("password") is still in every rainbow table
  • Compare SHA-1 vs SHA-256 length before picking a Git-era checksum
  • HMAC belongs on the HMAC page; this page is unkeyed hashes

SHA-512 is not password storage

SHA-512 is not password storage. MD5 is not integrity. A hex digest is a fingerprint of bytes, not a lock, and treating it as either is how leaks happen.

Paste the text (or pick a file). Read the algorithm name before you copy the hex. If this is a password, stop and use Argon2 or bcrypt instead.

Checksums for “did the download match”: SHA-256 or SHA-512. Compare against the vendor’s published digest on /hash/compare. MD5 and SHA-1 are broken for anything adversarial. They still catch accidental bit flips. They do not stop someone who wanted a collision. Same bytes, same digest, always. One flipped bit, a different digest. If two files match on SHA-256, they are the same bytes.

Hex vs Base64 is encoding of the digest, not a different hash. Don’t mix them in a compare.

Examples

Valid - MD5 of a common password (rainbow-table bait)
Input: password
MD5: 5f4dcc3b5aa765d61d8327deb882cf99
Do not store this.
Valid - SHA-256 of empty string (known test vector)
SHA-256("") =
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Valid - Avalanche: one bit of case
SHA-256("Hello") != SHA-256("hello")

Frequently Asked Questions

Can I use SHA-512 or SHA-256 for passwords?

SHA-512 is not password storage. MD5 is not integrity. A hex digest is a fingerprint of bytes, not a lock, and treating it as either is how leaks happen. If this is a password, stop and use Argon2 or bcrypt instead. Do not hash passwords with SHA-256 or SHA-512, “even with a salt you invented.” Use a password hash (Argon2, bcrypt, scrypt). Fast hashes are a feature for checksums and a bug for passwords.

Which algorithm should I use for a download checksum?

Checksums for “did the download match”: SHA-256 or SHA-512. Compare against the vendor’s published digest on /hash/compare. MD5 and SHA-1 are broken for anything adversarial. They still catch accidental bit flips. They do not stop someone who wanted a collision.

If two SHA-256 hashes match, are the files the same?

Same bytes, same digest, always. One flipped bit, a different digest. If two files match on SHA-256, they are the same bytes. Hex vs Base64 is encoding of the digest, not a different hash. Don’t mix them in a compare.

Is this HMAC? Why did a large file freeze the tab?

HMAC is not this page. If you needed a signature with a secret, you needed HMAC, not a raw digest. File hashing should not freeze the tab. If it does, the work is still on the main thread; that’s a bug in the tool, not in your file.

Tips

  • Publish SHA-256 checksums next to downloads. MD5 as the only checksum is 2005 advice.
  • If you need a password hash, leave this page. Argon2id is the current default recommendation.
  • Hex vs Base64 is presentation. The bits are the same digest.

Common Mistakes

Do not hash passwords with SHA-256 or SHA-512, “even with a salt you invented.” Use a password hash (Argon2, bcrypt, scrypt). Fast hashes are a feature for checksums and a bug for passwords.
HMAC is not this page. If you needed a signature with a secret, you needed HMAC, not a raw digest.
File hashing should not freeze the tab. If it does, the work is still on the main thread; that’s a bug in the tool, not in your file.

Related Tools

JWT Decoder

HS256 is HMAC-SHA-256 of the token, not a password hash

Try it

PDF Compress

Checksum the file after you shrink it

Try it

UUID Generator

Need a unique id, not a digest of content

Try it