Skip to content

Hash & Checksum Generator

Generate SHA-1/256/384/512 hashes of text or files, in your browser.

Format
chars bytes
📁

Hashed locally — your file never leaves your device

% read…

⚠️ Text changed — results below are out of date.

SHA hashes use your browser's native Web Crypto API; MD5 and CRC32 run in pure JavaScript — 100% offline, nothing is uploaded. Note: MD5 and SHA-1 are fine for checksums but cryptographically broken; prefer SHA-256+ for security.

Why you’ll love Hash & Checksum Generator

Instant & freeNo signup, no paywall, no limits — Hash & Checksum Generator works the moment the page loads.
Completely privateEverything runs in your browser. Nothing you enter is ever uploaded or stored on a server.
Works on any deviceFully responsive and touch-friendly — use it on your phone, tablet or desktop.
Built by developersAccurate, fast and keyboard-friendly — the details developers care about.

How to use it

  1. 01

    Open it

    No download and no login — the tool is ready right at the top of this page.

  2. 02

    Use it

    Enter your details or start interacting. Everything updates live as you go.

  3. 03

    Get your result

    Copy, download or share your result in a single tap. That’s it.

About Hash & Checksum Generator

This tool computes six digests side by side — MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 — for any text you type or any file you drop in. Output can be lowercase hex, UPPERCASE hex or Base64, and you can switch off the algorithms you do not need. In text mode, results update live as you type (with a byte count, since hashing works on UTF-8 bytes, not characters).

Everything happens locally. The SHA family is computed with your browser's native Web Crypto API, which is fast enough to hash large files in moments. Web Crypto deliberately omits MD5 and CRC32, so those run as pure-JavaScript implementations bundled with the page. Files are read with the FileReader API directly into memory — nothing is uploaded, and a progress bar tracks the local read. Files over 1 GB trigger a warning because holding them in memory can strain a browser tab.

The verify box is the practical half of the tool: paste the checksum a download page publishes and it is compared against every computed digest, automatically detecting which algorithm it matches. A green match means your copy of the ISO, installer or firmware image is byte-for-byte identical to what the publisher hashed; a mismatch means the download is corrupted or has been tampered with.

One caveat the tool itself flags: MD5 and SHA-1 are cryptographically broken — researchers can manufacture two different inputs with the same hash — so they should never protect anything security-sensitive. They remain perfectly fine for detecting accidental corruption, but for signatures, integrity guarantees or anything adversarial, use SHA-256 or stronger.

Popular uses

  • ✦ Verify a downloaded ISO or installer against the publisher's SHA-256 checksum
  • ✦ Generate MD5/SHA sums to publish alongside your own release files
  • ✦ Confirm two copies of a file are byte-identical by comparing digests
  • ✦ Produce Base64 SHA-384 digests for subresource integrity (SRI) attributes
  • ✦ Spot-check that a config or firmware file has not been modified

Frequently asked questions

Are my files uploaded when I hash them?
No. The file is read into your browser's memory with the FileReader API and hashed there — the progress bar reflects the local read, not an upload. Nothing crosses the network, so it is safe to checksum confidential documents, licensed installers or private keys backups. Very large files (over 1 GB) prompt a warning first because holding them in tab memory can be slow, especially on phones.
Which hash should I use to verify a download?
Whichever one the publisher lists — you must compare like with like. Most projects publish SHA-256 today; older mirrors still list MD5 or SHA-1. Drop the file here, paste the published value into the verify box, and the tool auto-detects which of the six algorithms it matches, so you do not even need to know which hash it is beforehand.
If MD5 is "cryptographically broken", why is it still offered?
Broken means collisions can be manufactured on purpose: an attacker can craft two different files with the same MD5, so it cannot be trusted for signatures, certificates or password storage. But random corruption during a download still changes the MD5 with near-certainty, and an enormous amount of existing tooling, mirrors and legacy systems still publish MD5 sums — so it stays useful for integrity checks and interoperability.
What is CRC32 and how is it different from SHA-256?
CRC32 is a 32-bit error-detecting checksum, the same one used inside ZIP archives, PNG images and Ethernet frames. It is designed to catch transmission errors, not adversaries — it is trivial to construct data matching a given CRC32. SHA-256 is a 256-bit cryptographic hash designed so that finding any two inputs with the same output is computationally infeasible. Use CRC32 for quick corruption checks, SHA-256 when it matters who could have altered the data.
Why do hex and Base64 outputs look so different for the same hash?
They encode the same bytes two ways. Hex spends two characters per byte, so a SHA-256 digest is 64 hex characters; Base64 packs three bytes into four characters, so the same digest is 44 characters ending in "=". Some systems expect one form or the other — HTTP digest headers and subresource integrity use Base64, while most checksum files use hex — which is why both are offered.
Is Hash & Checksum Generator free to use?
Hash & Checksum Generator is 100% free — no signup, no watermarks and no usage limits. It’s one of 200+ free tools we build and give away.
Is my code or data sent anywhere?
Never. Everything is processed locally in your browser — safe for secrets, tokens and proprietary code.

We built this. We can build yours.

Hash & Checksum Generator is one of our free tools. Need a website, app, AI agent or automation? Fixed price — and you own the code.