Hash Generator

About hashing

Why include MD5 and SHA-1 if they're considered "broken"?

MD5 and SHA-1 are broken for collision resistance — an attacker can deliberately craft two different inputs with the same hash — which rules them out for anything security-critical like password storage or verifying a file wasn't tampered with by an adversary. They're still ubiquitous for non-adversarial uses though: git object ids, cache keys, checksums to catch accidental corruption, deduplication. For anything security-sensitive, use SHA-256 or SHA-512 instead.

Why does my hash not match the same text hashed elsewhere?

Hashing operates on the exact bytes of the UTF-8 encoding of your input, so any difference — a trailing newline, different line-ending style (\n vs \r\n), leading/trailing whitespace, or a different text encoding entirely — produces a completely different digest. Check the input bytes stat below matches what you expect.

Can I use this to verify a downloaded file?

Not directly — this tool hashes the text you paste, not file bytes, and pasting a binary file's content as text risks silently corrupting it (encoding conversion, line-ending changes). For verifying a downloaded file against a published checksum, use a dedicated file-hashing utility that reads the file's raw bytes.

Does this tool upload my data anywhere?

No. Hashing happens entirely in your browser — MD5 with a small hand-rolled implementation, everything else via the browser's native Web Crypto API. Nothing you type ever leaves your device.