Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests for any text or file — instantly, locally, with nothing uploaded.
—————A hash is a fixed-length fingerprint of a byte stream. Change a single bit anywhere in the input and the output changes completely. That makes hashes ideal for answering one specific question: is this file byte-for-byte the file I expected?
Against accidental corruption — a truncated download, a bad USB stick — even MD5 is perfectly adequate. Against a deliberate attacker, MD5 and SHA-1 are broken: crafted collisions have been demonstrated for both. Use SHA-256 or stronger whenever the hash has to withstand someone actively trying to fake it.
Files are read into memory before hashing, so multi-gigabyte images are better handled by sha256sum or certutil -hashfile on the command line. Everyday downloads, archives and documents are fine here.
Related: Base64 encoder, UUID generator, ZIP extractor.
SHA-256 for anything security-related. MD5 and SHA-1 are broken against deliberate collisions and must not be used for signatures or passwords — but they are still fine for verifying that a download was not corrupted in transit, which is why they are here.
Drop the file here, pick the algorithm the publisher listed, and compare the two strings. If a single character differs, the file is not the one that was published.
No. Hashing uses your browser’s built-in WebCrypto engine, so the file is read locally and never transmitted.
WebCrypto deliberately omits MD5 because it is cryptographically broken. This page includes a small local implementation so checksum workflows that still use it keep working.
No. Both algorithms have practical collision attacks, so an attacker can construct different data with the same digest. Use SHA-256 or stronger, and obtain the expected checksum from a trusted source.