{jsonbody.com}

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes from text or a file, all at once. Everything runs in your browser, so your data stays private.

Calculate hashes from text or a file

A hash function turns input of any size into a fixed-length fingerprint. The same input always gives the same result, while a tiny change produces a completely different one. This tool calculates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at the same time as you type, or for a file up to 500 MB. The results appear as hexadecimal, in lowercase by default, with a copy button on each row.

Everything is computed on your device. Your file is read by the browser and not uploaded, so even a large file stays private.

Example hashes

The classic test sentence below shows how fixed-length output works, and a trailing full stop changes the entire result. Note that a trailing newline counts too, which is the usual reason a value here differs from a command-line tool.

The quick brown fox jumps over the lazy dog
MD5      9e107d9d372bb6826bd81d3542a419d6
SHA-1    2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
SHA-256  d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

With a final full stop:
MD5      e4d909c290d0fb1ca068ffaddf22cbd0

Checking a downloaded file

Software projects often publish a checksum next to a download. Press Hash a file, select the download, and compare the result with the published value. If they match, the file arrived intact. A checksum obtained from the same place as the download confirms integrity but not necessarily authenticity, so signed releases give stronger protection. The equivalent terminal commands are sha256sum file.iso on Linux, shasum -a 256 file.iso on macOS, and certutil -hashfile file.iso SHA256 on Windows.

Which algorithm should you use?

  • SHA-256 is the modern default for checksums, signatures and content addressing.
  • SHA-384 and SHA-512 give longer output. SHA-512 can be faster on 64-bit machines.
  • MD5 and SHA-1 are broken for security because attackers can create collisions. They are only suitable for non-security uses such as detecting accidental changes or matching older systems.

Hashes are not for storing passwords

Fast hashes make password cracking easy. A modern graphics card can try billions of SHA-256 guesses per second, and precomputed tables reverse common passwords instantly. Store passwords with a slow, salted algorithm designed for the job, such as Argon2id or bcrypt, for example through password_hash() in PHP. Hashing is also not encryption. It is one-way by design, so there is no key that can recover the input.

Frequently Asked Questions

Why doesn't my result match the terminal?

The command echo text | sha256sum includes a newline in the input. Use echo -n text or printf to hash exactly the same bytes.

Can a hash be reversed?

Not mathematically. But short or common inputs can be found by guessing or through lookup tables, which is why websites that claim to decrypt MD5 appear to work.

Why do SHA hashes need HTTPS?

Browsers only expose their built-in SHA functions on secure pages. MD5 is computed with a separate library, so this limit does not apply to it.

Is uppercase or lowercase output correct?

Both are the same value, as hexadecimal digits are not case-sensitive. Use the Uppercase option if your target system expects capitals.