/en/tool/hash-generator/ works calculated in your browser
Drop files onto the panel — hashes are calculated on your device, no matter how large the file is. Verification accepts both a single checksum and a complete SHA256SUMS file: the tool matches entries to file names and tells you which ones match and which do not.
Paste text or drop files directly onto the panel — you can add several at once, including a folder. Hashes are calculated on the fly; there is no “Calculate” button.
Select the algorithms you need. By default, MD5, SHA-1, SHA-256, and SHA-512 are calculated; enable CRC32, SHA-384, and SHA-3 by selecting them. Selected algorithms are calculated in one pass over the file, but their processing times add up — for an image several gigabytes in size, it is better to disable unnecessary ones.
To verify a downloaded file, paste the checksum from the release description into the verification field. You do not need to guess the algorithm: the tool identifies the hash by its string length and automatically selects it if it was disabled.
To verify a set of files, paste the entire checksum file there as it appears alongside the release. Each line will be matched to its file, and the table will show “matched” or “did not match”; extra and missing names will be listed separately.
To find out whether two files are identical, drop both at once: matching files are detected automatically, and the verdict will say “byte-for-byte identical.” No need to compare strings by eye.
Download the result as a file: “Checksum file” provides a ready-made list for verification with sha256sum -c, CSV opens in a spreadsheet, and JSON is suitable for reports.
The input data is the same as the default field values: you can calculate it mentally and confirm that the tool is telling the truth.
MD5 produces 128 bits, which is 32 hexadecimal characters.
SHA-1 is 160 bits, 40 characters. SHA-256 is 256 bits, 64 characters. SHA-512 is 512 bits, 128 characters.
In base64, the same bytes are written more compactly: SHA-256 takes 44 characters instead of 64. The value is the same; only the notation differs.
Hash length does not depend on input length: SHA-256 always produces 64 characters, whether the input is one letter or a gigabyte file.
MD5 = 6c3cce14acf8585a366c78f9635ae08d, SHA-1 = 10c0e331cf698ea4812bc4a0fcea2f881e7e1e51, SHA-256 = 27f9c2821159f9b702b9f2341cbd1d6815f32ea86cbec17ea98a65d809d1e00f, and its integrity attribute string is sha256-J/nCghFZ+bcCufI0HL0daBXzLqhsvsF+qYpl2AnR4A8=.
There is no limit. The file is not loaded into memory all at once: the browser cuts it into 4 MB chunks and feeds them to the calculation one at a time, then immediately discards each calculated chunk. At any given moment, memory holds those 4 MB and the algorithm state — a few dozen bytes. A four-gigabyte distribution image is calculated exactly like a text file, just more slowly. The progress bar shows how much is left, and you can stop the process with a button.
No. The calculation runs in a separate thread (Web Worker), not the one that renders the page. You can use the fields, scroll the page, and the “Cancel” button responds immediately. If the browser cannot create a separate thread for some reason, the tool calculates on the main thread, but still in chunks, with pauses between them.
SHA-3 uses a different construction internally: the Keccak “sponge,” where a 1600-bit state is mixed over twenty-four rounds. JavaScript has no 64-bit integers, so each word must be stored as two 32-bit halves, which reduces speed. The order is as follows: CRC32 and MD5 handle hundreds of megabytes per second, SHA-256 around one hundred and fifty, and SHA-3 tens. If you are verifying a large image against one published checksum, select only its algorithm.
HMAC is a hash with a secret key. Anyone can calculate a regular hash, so it proves integrity only: the file was not corrupted. HMAC also proves authenticity — it can match only for someone who knows the key. It is used to sign webhooks and payment gateway requests: the service sends a signature in a header, you calculate the HMAC of the request body using your key and compare it. The key can be entered here as a string, hexadecimal notation, or base64 — payment systems provide it in different formats.
This is Subresource Integrity — the value of the integrity attribute on script and link tags. The browser calculates the hash of the loaded file itself and refuses to execute it if the value does not match. This prevents a third-party library from an external URL from being replaced unnoticed. The format is strict: algorithm name, hyphen, and base64 — so the string is shown separately and does not change with the format switcher.
Because your browser downloads it, and it does not allow a page to read content from an external URL without the owner’s permission — this rule is called CORS. If the server does not send the Access-Control-Allow-Origin header, the response never reaches the page, so there is nothing to calculate. There is only one solution: download the file and drop it into the field above. On the other hand, this means the file does not pass through our server and is not written to disk.
For two reasons. First, MD5 collisions can be constructed — two different data sets with the same hash — so it is not suitable for signatures. Second, and more importantly for passwords, MD5 is very fast. A good password hashing function must be slow and require memory, so brute-force attempts are expensive. Use bcrypt, scrypt, or Argon2 for passwords, not MD5 or SHA.
To verify that a file was downloaded completely and was not corrupted. They protect against accidental damage no worse than other algorithms, and checksums for old archives are published in MD5; CRC32 is included in every zip and distributed alongside firmware. Neither works against malicious intent: forging a file for a known MD5 is feasible, and forging one for a known CRC32 is trivial.
As a checksum, yes. As a signature, no: SHA-1 collisions have been demonstrated in practice, and browsers and certificate authorities have abandoned it. If you are choosing now, use SHA-256, or SHA-512 or SHA3-256 where you need a margin for years ahead.
No. It is a one-way function: the original data cannot be recovered from a hash. Services that promise to “decrypt MD5” simply look up the string in a precomputed table of hashes. This works for short, common strings, but not for long ones.
Creates passwords of the required length and assesses how difficult they are to crack.
Open