A hash is a fixed-length fingerprint of any input. Feed this tool a single word or a 2 GB file and it returns a string that changes completely the moment one byte of the input changes. Same input, same hash, every time. That one-way, deterministic behavior is what makes hashes useful for proving a file arrived intact or that two things are identical. Everything runs in your browser through the Web Crypto API, so whatever you drop here never leaves your machine.
What a hash is (and what it isn't)
Four properties define a cryptographic hash:
- One-way — you can go from input to hash, never back. There is no key to undo it.
- Fixed length — MD5 is always 32 hex characters, SHA-256 always 64, no matter how large the input is.
- Deterministic — the same input always produces the same hash on any machine.
- Avalanche effect — change one character and roughly half the output bits flip, so similar inputs look nothing alike.
A hash is not encryption. Encryption is reversible with a key; hashing is a dead end by design. If your goal is to hide data you can later read back, you want encryption, not this.
Which algorithm should you use?
My recommendation: reach for SHA-256 unless a specific standard tells you otherwise. It is the modern default for a reason.
- SHA-256 — the workhorse. TLS certificates, Bitcoin, and most software checksums rely on it. No practical weaknesses.
- SHA-384 / SHA-512 — the same family with longer output, and often faster than SHA-256 on 64-bit hardware for large files. Good for long-lived signatures.
- SHA-1 — broken. Google published a real collision in 2017 ("SHAttered"). Acceptable only as a non-security checksum where you control both ends.
- MD5 — broken since the mid-2000s; collisions take seconds to produce. Still common as a fast integrity check for accidental corruption, never for security.
The most common job: verifying a download
Projects often publish a checksum next to a download. To use it: grab the file, drop it here, pick the algorithm the project listed (usually SHA-256), then compare your result to theirs character for character. A match means the file is byte-for-byte intact. This catches a corrupted download and a tampered mirror alike — but only if you trust where the published checksum came from, which is why serious projects deliver checksums over HTTPS or sign them.
Don't hash passwords with this
A plain SHA-256 of a password is not safe storage. Fast hashes are exactly what an attacker wants: a modern GPU tries billions of guesses per second. Real password storage uses a slow, salted algorithm built for the job — bcrypt, scrypt, or Argon2. Use this tool for integrity checks, not to build a login system.
FAQ
Can I reverse a hash back to the original text?
+
No. Hashing is a one-way function — there is no key and no decrypt step. Sites that claim to "reverse" a hash just keep a lookup table of hashes for common words and leaked passwords. They can't reverse the hash of anything unusual.
Why do MD5 and SHA-256 give different-length results?
+
Output length is fixed by the algorithm, not your input. MD5 is 128-bit (32 hex characters), SHA-256 is 256-bit (64 characters), and SHA-512 is 512-bit (128 characters). A one-word input and a huge file produce the same length hash.
Is MD5 safe to use?
+
Not for anything security-related. Collisions can be generated in seconds, so MD5 must not guard passwords, signatures, or downloads from an untrusted source. It's fine only as a quick checksum for accidental corruption where nobody is attacking you.
Does my file get uploaded?
+
No. Hashing happens in your browser via the built-in Web Crypto API. Your text and files never leave your device — nothing is uploaded, logged, or stored.
What is a hash collision?
+
A collision is two different inputs producing the same hash. Secure algorithms make this infeasible; MD5 and SHA-1 have known practical collisions, which is exactly why they're considered broken for security use.