Loading…
Loading…
MD5, SHA-1, SHA-256, SHA-512 hashes in your browser
Run your projects on Claude Code?
We packaged the .claude config that runs this site — 26 specialist agents, 14 workflow skills, and 6 rule files from 31 real production incidents. From $9.
Get the Claude Code Production Pack — $29Cryptographic hash functions map arbitrary-length input to a fixed-length output in a one-way, deterministic process. The SHA-2 family (SHA-256, SHA-512) is specified in FIPS PUB 180-4 and forms the backbone of TLS certificates, code signing, Git commit identifiers, and API request signing. MD5 (128-bit) and SHA-1 (160-bit) remain common for non-security checksums despite being collision-vulnerable. SHA-256 (256-bit) is the current minimum recommendation for security applications; SHA-512 provides additional collision resistance for high-security contexts.
Hashing in the browser uses the Web Crypto API's SubtleCrypto.digest() method, which is implemented natively in all modern browsers and runs in a separate thread to avoid blocking the main UI. The method accepts an algorithm name ("SHA-256", "SHA-512") and an ArrayBuffer of the input data, and returns a Promise resolving to an ArrayBuffer of the hash output.
For text input, the input string is encoded to UTF-8 bytes using TextEncoder before being passed to digest(). For file input, the file is read as an ArrayBuffer using FileReader.readAsArrayBuffer() and passed directly.
MD5 is not part of the Web Crypto API (intentionally omitted due to its deprecated security status), so the tool implements MD5 in pure JavaScript using the RFC 1321 specification for completeness. The SHA variants use the native implementation.
Hash output is converted from ArrayBuffer to a hexadecimal string by mapping each byte to its two-digit hex representation.
A developer verifies the SHA-256 checksum of a downloaded binary matches the hash on the official release page before installing it on a server.
A backend developer generates an MD5 hash of a large file to use as a cache key or ETag value for HTTP caching.
A security engineer checks whether two versions of a configuration file are identical by comparing their SHA-256 hashes without doing a manual diff.
A developer generates SHA-512 hashes of sensitive log entries before archiving them to create a tamper-evident audit trail.
Scope note: This tool is suitable for checksums and non-security hashing tasks. For password storage, use a purpose-built password hashing function (bcrypt, scrypt, or Argon2) — not SHA-256 or SHA-512 directly, as they are too fast and lack a cost factor. For HMAC signatures, the JWT Decoder and HMAC tools provide the appropriate interface. Avoid pasting sensitive data in shared or screen-shared environments even though no server transmission occurs.
Type text or upload a file to hash
All hash variants (MD5, SHA-1, SHA-256, SHA-512) are shown simultaneously
Click any hash to copy it
About the Hash Generator
Completely. All hashing is done in your browser using the Web Crypto API. No data is ever uploaded to any server.
SHA-256 is the current standard for most applications. MD5 and SHA-1 are deprecated for security use but still used for checksums. SHA-512 offers higher security for sensitive applications.
Both algorithms are vulnerable to collision attacks — where two different inputs produce the same hash output. SHA-1 was formally broken in 2017 (SHAttered attack). MD5 collisions can be computed in seconds. Neither should be used for digital signatures, password hashing, or integrity verification of security-critical files.
Yes. SHA-256 is the standard for file integrity checks. Download the file, compute its SHA-256 hash, and compare it against the hash published by the software vendor. A match confirms the file was not corrupted or tampered with in transit.
The tool reads files in chunks using the FileReader API and feeds them to the Web Crypto API digest incrementally. Files up to several hundred megabytes can be hashed without issues. Very large files (1GB+) may cause memory pressure depending on your browser and available RAM.
No. SHA-256 is a one-way hash function that takes input and produces a fixed-length digest. HMAC-SHA256 (Hash-based Message Authentication Code) uses a secret key combined with SHA-256 to produce a signature that proves both the data integrity and the identity of the signer. Use SHA-256 for checksums; use HMAC-SHA256 for API authentication and webhook verification.
Builder/critic agent prompts with brakes built in
Open →DeveloperFormat, validate & diff JSON — runs entirely in browser
Open →DeveloperTest regex live — railroad diagrams + plain English explained
Open →DeveloperOne color in, full design system out
Open →