Hash Generator (MD5, SHA-1, SHA-256)

How it works

Tap or click the box to choose your files, then press Calculate hash; every file gets a row showing the checksum for the algorithm you selected. If the download page published a 64-character SHA-256 value, paste it into the Expected checksum field: the tool compares it with what it worked out and states plainly whether the file is verified or does not match. Capitals and stray spaces are ignored, so pasting straight from a web page is safe. Everything is computed inside your browser and the file itself never leaves your device — which is also why there is a 1 GB limit per file, since the bytes have to be read into memory. When a single algorithm is selected, the download button hands you a text file in sha256sum format; that same file can be checked on the command line with sha256sum -c. You can select several files at once and each is hashed separately.

This tool is also known as md5 hash generator, sha256 checksum, file hash calculator, sha1 hash generator, verify checksum, online hash generator.

What is Hash?

A hash is a fixed-length fingerprint derived mathematically from every byte of a file; the same value is also called a checksum or a digest. It makes no difference whether the file is two kilobytes or twenty gigabytes — the hash is always the same length, and the same file always produces the same hash. Change a single bit and the hash changes completely, bearing no resemblance to the previous value. Comparing two hashes therefore gives the same answer as comparing two files byte by byte, far faster and without needing both copies in one place.

What is SHA-256?

SHA-256 is the 256-bit member of the SHA-2 family published by the American standards body NIST, and it is the de facto standard for verifying file integrity today. Its output is 64 hexadecimal characters. No practical method for producing two different files with the same SHA-256 value is known, which is why software downloads, operating system images and backup archives publish their checksums in this form — a Linux distribution, for instance, lists a SHA-256 line beside every disc image it offers.

What is the difference between MD5 and SHA-256?

Both reduce a file to a fixed-length value; the difference is the safety margin. MD5 was designed in 1992 and its 128-bit output is 32 characters long, and two different files carrying the same MD5 can be produced deliberately today — so it is only good for catching accidental corruption. SHA-256 produces a 256-bit, 64-character value and has no known practical collision attack, which makes it the right choice anywhere you need to show that content was not altered. Verifying an MD5 that an older source published is still legitimate; publishing your own checksums with it is not.

MD5 and SHA-1 catch accidents, not attackers

Collisions were demonstrated for both years ago: two different files can be crafted deliberately to carry the same MD5 or SHA-1 value. If someone tampers with a download and republishes the original checksum, a match proves nothing in that scenario. SHA-256 has no known practical collision, which is why publishers moved to it.

That does not make the older two useless. They still catch accidental damage reliably — a half-finished download, a bad copy, a corrupted archive. Verifying an MD5 that an older system published is perfectly reasonable; publishing a new checksum with MD5 is not.

This is file integrity, not password security

A checksum answers one question: are these bytes the ones I expected? It is not a way to protect a password. MD5, SHA-1 and SHA-256 are all built to be fast, and speed is exactly what an attacker holding a stolen database wants — billions of guesses a second, plus ready-made lookup tables for every common password.

Password storage uses algorithms designed to be slow and salted for that purpose, such as bcrypt, scrypt or Argon2. If what you are hashing is a password, none of the three algorithms offered here is the right tool, whichever one you pick.

Which algorithm should you choose?

Match whatever was published: use the algorithm the other side used. If you are unsure, the length tells you — 32 characters is MD5, 40 is SHA-1, 64 is SHA-256. Paste the value into the Expected checksum field with all three selected and the tool works out which algorithm it belongs to and says so.

For a checksum you are creating yourself — archiving a file so you can prove later that it never changed, or letting someone confirm a file arrived whole — choose SHA-256. The all-three option exists for reconciling old records against new ones in a single pass.

Frequently asked questions

How do I check the SHA-256 of a file?

Choose the file, leave the algorithm on SHA-256 and press Calculate hash. The 64-character value appears in that file's row. The work happens inside your browser, so the file is not uploaded anywhere.

Can anyone read my file from its hash?

No. A hash runs one way only: the file produces the checksum, but the checksum cannot rebuild the file. Sharing a checksum is not sharing content — although it does let someone prove whether their copy is byte-for-byte the same as yours.

The checksum does not match — what now?

Count the characters first: 32 means MD5, 40 means SHA-1, 64 means SHA-256, so the publisher may simply have used a different algorithm. If the algorithm is right, the file is either corrupt or altered; download it again and repeat the check.

How do I tell whether two files are identical?

Select both and hash them together. Identical checksums mean the contents are byte-for-byte the same, whatever the names or dates say. One differing character means the contents differ.