Hash Generator

MD5 and SHA-256 are both hash functions: they turn any input into a fixed-length "fingerprint" (32 hex characters for MD5, 64 for SHA-256). The difference is strength. MD5 is older and fast but cryptographically broken — it is possible to craft two different files with the same MD5 — so it should only be used for non-security checks like detecting accidental corruption. SHA-256 (part of the SHA-2 family, alongside SHA-384 and SHA-512) has no known practical collisions and is the modern default for integrity and signatures. This tool generates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once so you can use whichever the situation calls for.

No — a plain MD5 or SHA-256 hash is the wrong tool for storing passwords. Because these functions are fast and unsalted, an attacker who steals the hashes can test billions of guesses per second with rainbow tables. For passwords you should use a slow, salted password-hashing algorithm such as bcrypt, scrypt or Argon2. This generator is meant for file checksums, data integrity, cache keys, ETags, deduplication and verifying downloads — not for password storage.

Switch the input to "File", then choose or drag in the file you downloaded. The tool reads it locally and shows its MD5 and SHA hashes. Copy the checksum the publisher listed next to the download, paste it into the "Compare with a hash" box, and the matching algorithm row lights up with a "match" badge — telling you both that the file is intact and which algorithm the checksum used. Pasting in either hexadecimal or Base64 form works, and the comparison is case-insensitive for hex.

No. Every hash is computed entirely in your browser using the built-in Web Crypto API (for the SHA family) and a small bundled library (for MD5). Your text and files never leave your device and nothing is sent over the network, so even sensitive documents stay private and the tool keeps working offline once the page has loaded.

Yes. By default hashes are shown as lowercase hexadecimal, but you can switch the letter case to UPPERCASE, or change the output format to Base64 — handy for things like Subresource Integrity (SRI) values and HTTP headers that expect Base64-encoded digests. Each hash has its own copy button, and "Copy all" grabs every algorithm at once.