scriptiii
100% Client-Side

Text or file → digest

Hash generator

MD5, SHA-1, SHA-256 and SHA-512 digests for text or a local file, with a checksum comparison that ignores formatting and names weak algorithms out loud.

Hex or Base64; case and separators ignored.

Hashed as UTF-8 bytes.

Algorithms

Text and files are hashed in this tab with a bundled JavaScript implementation. Nothing is uploaded, and the file bytes are dropped as soon as the digests are shown.

Short answer: paste text or choose a file and the digests appear as you type. Use SHA-256 for anything security-related and the checksum box to verify a download. MD5 and SHA-1 are included because plenty of publishers still list them — the result marks them as weak rather than pretending they are equivalent.

What a hash proves

A digest maps bytes to a fixed-length value. If two files produce the same SHA-256, they are the same file with overwhelming probability. That makes a digest a good check for a corrupted download or a changed artefact, and a bad check for identity: a hash is not a signature, because anyone who can change the file can also change the published hash.

Where each algorithm belongs

Verifying a download, step by step

Download the file, publish-sha256 or similar checksum from the vendor's own site (not from the same page that served the file), then hash the file here and paste the digest into the comparison box. A mismatch means a different file — a truncated download, a proxy that rewrote it, or something worse. Re-download over HTTPS before assuming the worst.

The digest is computed by one bundled implementation for all four algorithms, so the text and file paths cannot disagree. The published test vectors for “abc” are part of the test suite.

Hash and checksum questions

How do I check a downloaded file against its checksum?

Choose “a file”, pick the download, copy the hex digest the publisher lists into the checksum box, and read the match column. Case, spaces and colons are ignored, and Base64 spellings are accepted because published checksums appear in all of those shapes.

Is MD5 safe?

Not for security. MD5 collisions can be produced in seconds, so it cannot prove integrity or authenticate anything. It is still what many S3 ETags, legacy build manifests and vendor checksums publish, so verifying one is legitimate — using it to sign something is not.

Why is SHA-1 marked weak as well?

Chosen-prefix collisions against SHA-1 are practical enough that certificate authorities stopped accepting it. Like MD5 it remains useful for matching an existing value, which is the only thing this tool claims to do with it.

Does hashing a file upload it?

No. The file is read with the File API, hashed in this tab and discarded when you navigate away. There is no upload endpoint; the 8 MB limit exists because the whole file is held in memory while hashing.

Can I hash a password with this?

No. A plain SHA-256 of a password is not a password hash — it is fast, unsalted and reversible with a rainbow table. Password storage needs a slow, salted KDF such as Argon2id, scrypt or bcrypt, and this page does not offer one because a browser page is the wrong place to handle a password.

What is the difference between the hex and Base64 columns?

Both encode the same digest bytes. Hex is what most checksum files and documentation use; Base64 is what APIs, HTTP digests and JWT headers tend to use. Comparing bytes is what matters, so either spelling identifies the same value.

Related tools

Base64 encoder and decoderThe Base64 spelling of the same bytes.JWT decoderTokens carry a signature, not a hash.Random string generatorSecrets with real entropy maths.Text diffSee what changed between two files.BCrypt generatorPassword hashing with a tunable cost, computed in the tab.