Free hash generator — text and files
Compute MD5, SHA-1, SHA-256, SHA-384, SHA-512 in your browser. Verify download integrity by pasting the published checksum.
Runs on native crypto.subtle for the SHA family plus a small inline MD5 implementation. Files never leave your device — verify a 500MB ISO the same way you would a text snippet, with zero network requests.
How to verify a downloaded file
- Find the publisher's published checksum (usually next to the download link, or in a
SHA256SUMSfile). - Drop the downloaded file into the panel above. All five hashes compute locally.
- Copy the algorithm that matches (SHA-256 most common) and paste the publisher's expected value into the Verify Integrity box.
- Green badge = file matches; the download was not corrupted or tampered with in transit.
This is the standard integrity check for OS ISOs, package tarballs, PGP-signed releases, and app installers. No CLI needed — the same math sha256sum or certUtil runs, just in your browser.
How this compares
| Feature | Hash (nap tools) | md5file.com | sha256sum CLI |
|---|---|---|---|
| Hash text and files | ✓ Both | Files only | Files only |
| MD5 + SHA-1 + SHA-256/384/512 | ✓ All 5 at once | MD5 only | One per command |
| Verify against expected checksum | ✓ Auto-detect algo | Manual compare | ✓ With --check |
| Base64 output (SRI-ready) | ✓ | — | Extra pipe |
| Files never leave device | ✓ Browser-only | — Uploaded | ✓ Local |
| Works without install | ✓ Any browser | ✓ | — Needs CLI |
Which algorithm should you use?
- SHA-256 — modern default. Used by Git, TLS, Bitcoin, and every serious download checksum. Pick this unless a publisher specifies otherwise.
- SHA-512 — longer digest (128 hex chars), slightly slower, no meaningful security gain over SHA-256 for typical use.
- SHA-1 — deprecated for security (collisions found in 2017). Still shown for legacy compatibility with older tarballs and Git.
- MD5 — broken for security since the 2000s but still used as a fast integrity check on non-adversarial downloads (e.g., mirror sync verification). Never use for passwords or signatures.
Frequently asked
Is hashing reversible?
No. A hash is a one-way function — given the digest, you cannot reconstruct the original data. That is why hashes are used for password storage (in salted, slow forms like Argon2 or bcrypt, not raw SHA-256) and file integrity, not encryption.
Why does the same file give different hashes on different tools?
It should not, if both tools compute the same algorithm on the same bytes. Common causes of mismatch: one tool added a trailing newline, hashed the file as text with line-ending conversion (CRLF vs LF), or the file was modified/corrupted between the two runs. This tool hashes raw bytes exactly as the browser reads them.
MD5 or SHA-256?
MD5 for legacy compatibility only (still shown as checksums on some downloads). SHA-256 is the modern default. Never use MD5 for password storage.
How big of a file can I hash?
~500MB is comfortable, browser memory dependent. Very large files may take a few seconds — hashing is CPU-bound.
Is my data uploaded?
No. All hashing is client-side. Zero network requests.
Does auto-detect work by length?
Yes — MD5 = 32 hex chars, SHA-1 = 40, SHA-256 = 64, SHA-384 = 96, SHA-512 = 128. Base64-encoded hashes are also detected by prefix length.
Can I get Base64 output instead of hex?
Toggle "Also show Base64" in the toolbar. Base64 encoding is shorter than hex and is what most subresource-integrity (SRI) hashes use.
Free?
Yes. No signup, no daily cap, no paid tier.