How it works
A hash function turns any input - a word, a config file, a disk image - into a fixed-length string called a digest. Type or paste into Input text and all five digests recompute as you type (text is treated as UTF-8 bytes). Or pick a file under Or hash a file: it is read locally as raw bytes and hashed exactly as stored. Each result is shown as lowercase hexadecimal, with a copy button.
Two properties make hashes useful, and both shape how you read the output:
- Deterministic: the same input always yields the exact same digest. That is what lets you verify integrity: recompute the hash and compare it, character for character, against a value the publisher listed. It matches or it does not; there is no "close".
- Avalanche effect: flip a single bit of input and roughly half the output bits change. So a trailing space or newline in the text box, or a different line-ending in a file, produces a completely different digest. If your result disagrees with another tool, check the input bytes first.
To confirm a download, hash the file and compare against the vendor's published SHA-256. Hashes are one-way: you cannot turn a digest back into the original input by any means other than guessing.
MD5 vs SHA-1 vs SHA-256 vs SHA-512: which to use
| Algorithm | Output size | Hex length | Status | Use it for |
|---|---|---|---|---|
| MD5 | 128-bit | 32 chars | Broken | Legacy checksums only; collisions are trivial to produce. |
| SHA-1 | 160-bit | 40 chars | Broken | Legacy compatibility only; a practical collision was demonstrated in 2017. |
| SHA-256 | 256-bit | 64 chars | Secure | The default choice for integrity, signatures and fingerprints. |
| SHA-384 | 384-bit | 96 chars | Secure | A truncated SHA-512; used where a longer digest is mandated. |
| SHA-512 | 512-bit | 128 chars | Secure | Integrity where a larger margin (or 64-bit performance) is wanted. |
MD5 and SHA-1 are still fine for non-adversarial uses like deduplication or a quick "did this change?" check, but never for anything an attacker could forge. For new work, use SHA-256. And none of these suit password storage, plain hashes are far too fast; use a purpose-built bcrypt, scrypt or Argon2, which are deliberately slow and salted.
Frequently asked questions
What is the difference between MD5 and SHA-256?
Both map an input to a fixed-length digest, but MD5 produces a 128-bit (32-character) value and is cryptographically broken, anyone can craft two different files with the same MD5. SHA-256 produces a 256-bit (64-character) value and has no known practical collisions, so it is the safer default for verifying that a file or message has not been altered.
Can I reverse a hash back to the original text?
No. Hashing is one-way by design; the digest discards the information needed to reconstruct the input. When people appear to "crack" a hash they are guessing candidate inputs, hashing each one, and looking for a match, which only works for short, common or already-leaked values. There is no formula that inverts a hash.
Is a hash the same as encryption?
No. Encryption is reversible with the right key, so ciphertext can be turned back into the original. A hash is irreversible and keyless: it is a fingerprint, not a locked box. Use hashing to detect change or verify integrity, and encryption to keep data confidential.
Why does my hash differ from another tool's result?
Almost always an input difference, not a bug. A trailing newline, different text encoding, or Windows versus Unix line endings changes the bytes being hashed, and the avalanche effect turns that into a completely different digest. Also confirm both tools show the same case: this tool outputs lowercase hexadecimal, and some show uppercase.
Should I use this to store user passwords?
No. General-purpose hashes like SHA-256 are built to be fast, which is exactly wrong for passwords because it lets attackers test billions of guesses per second. Use a slow, salted password-hashing function, bcrypt, scrypt or Argon2, which are designed for this job.
crypto.subtle API (MD5 in JavaScript, since it is intentionally excluded from that API), and files are read locally as bytes, nothing you enter or select is ever uploaded. Remember that hashing is not encryption: a digest verifies integrity but cannot keep data secret and cannot be reversed.