Skip to content
ToolBoxGenie

Hash Generator

Developer Tools · Added 12 August 2026

Produce a cryptographic digest of any text or file, in hex or Base64, and check it against a checksum someone published. The hashing uses your browser's own Web Crypto implementation, so even a large file is read and digested on your machine rather than uploaded anywhere.

What to hash

Hashed as UTF-8 bytes. A trailing newline changes the result, which is the usual reason a hash does not match what a command line produced.

The current default. Used by TLS certificates, Bitcoin, most file checksums and almost every new system.

Case and surrounding spaces are ignored, since those are never the real difference.

How to use the hash generator

  1. 1Choose whether you are hashing typed text or a file on your disk.
  2. 2Pick an algorithm. SHA-256 is the right default unless something specific is asking for another.
  3. 3Read the digest in hex, or copy the Base64 form if the system you are feeding expects that.
  4. 4To verify a download, paste the checksum published by the project into the comparison box — case and stray spaces are ignored.
  5. 5A green result means the bytes are identical to what the publisher hashed. A red one means they are not.

Examples

The canonical test vector

Input
Text: abc, algorithm SHA-256
Result
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

This value is published in the SHA standard itself, which makes it a quick way to confirm any implementation.

Verifying a downloaded release

Input
The .iso you just downloaded, plus the SHA-256 line from the project's site
Result
Checksums match — the file is byte-for-byte what was published

This detects corruption and truncation. It only detects tampering if you trust the page the checksum came from.

Why a hash 'does not match' the command line

Input
Text typed with a trailing newline
Result
A completely different digest from the same text without one

echo adds a newline; echo -n does not. One invisible byte changes every character of the output.

About the hash generator

What a checksum actually proves

Comparing a downloaded file's hash against a published one proves that the bytes you hold are the bytes that were hashed. That is genuinely useful: it catches a truncated download, a corrupted disk, a proxy that mangled the transfer.

It proves rather less about tampering, and the reason is worth being precise about. If an attacker can replace the file, they can usually replace the checksum printed next to it. A checksum only becomes evidence of authenticity when it arrives by a different route than the file — a signed release manifest, a package index with its own signing key, a value you were told out of band.

Why SHA-1 is still here

SHA-1 has been unsafe for security purposes since 2017, when a practical collision was demonstrated: two different files with the same digest. Anything that depends on a hash being unique per input — signatures, certificates, tamper detection — cannot use it.

It remains in this tool because a great deal of the world still emits it. Git object ids are SHA-1, older release pages publish SHA-1 checksums, and legacy systems hand out SHA-1 fingerprints. Reading those values is a legitimate need; starting something new with them is not, which is why the tool says so when you select it.

Frequently asked questions

Can I get the original text back from a hash?
No. A hash is one-way by construction: it maps any amount of input to a fixed-size output, so information is destroyed on the way through. Sites claiming to 'decrypt' a hash are looking the value up in a table of pre-computed common inputs — which works for 'password123' and never for anything with real entropy.
Why is MD5 not offered?
Because the browser's Web Crypto API does not implement it, and that is a deliberate decision rather than an oversight. MD5 has been comprehensively broken for two decades — collisions can be produced on a laptop. Shipping a hand-written MD5 to fill the gap would mostly serve to keep it in use somewhere it should not be.
Is my file uploaded to check its hash?
No. The file is read into this browser tab with the standard file API and hashed here. There is no upload endpoint on this site, which is also why a very large file is limited by your own machine's memory rather than by any transfer limit.
SHA-256 or SHA-512 — does it matter?
For virtually every purpose, no. Both are unbroken members of the SHA-2 family. SHA-512 is often faster on 64-bit processors because it works on 64-bit words, and produces a longer digest. Use whichever the system you are talking to expects; if nothing is asking, SHA-256 is the safer interoperability bet.

Related tools