Hash Generator
Create and compare text or file checksums locally, without uploading them.
- Runs in your browser — files never leave your device
- Fewer clicks, keyboard friendly
How to use
- Choose Text or File, then enter text or select the file to check.
- Choose the checksum algorithm required by the publisher; SHA-256 is the default.
- Copy the lowercase hexadecimal digest, or paste a published digest into Expected hash.
- Use the Match result to confirm the selected bytes and expected checksum agree.
What bytes are hashed?
A hash is calculated from bytes, not from what text looks like on screen. In Text mode this tool first encodes the exact input as UTF-8. It does not trim spaces, normalize Unicode, or add a final line break. Therefore `hello`, `hello `, and `hello\n` have different digests. In File mode the original file bytes are read directly; an image, ZIP, or executable is not decoded as text. This distinction is why a downloaded file should be checked in File mode, while a configuration value or API payload is normally checked in Text mode.
The common hexadecimal form uses two characters per byte. SHA-256 is 32 bytes and therefore 64 hexadecimal characters; SHA-384 is 48 bytes (96 characters), SHA-512 is 64 bytes (128 characters), SHA-1 is 20 bytes (40 characters), and MD5 is 16 bytes (32 characters). The SHA output lengths are specified by NIST FIPS 180-4, while MD5’s 128-bit digest format is specified by RFC 1321.
Choose a checksum algorithm deliberately
For a new file-integrity workflow, use the same algorithm that the publisher supplies; SHA-256 is the usual modern choice. Web Crypto natively provides SHA-1, SHA-256, SHA-384, and SHA-512, so this tool delegates those digests to the browser. MD5 is included only to match legacy manifests and systems that still publish a 32-character checksum. It is implemented locally because MD5 is intentionally not a Web Crypto digest algorithm.
A matching checksum shows that the bytes you selected produce the same digest as the value you pasted. It does not prove who published that value. Obtain a checksum from an authenticated publisher page or a signed release manifest. Do not use MD5 or SHA-1 for passwords, digital signatures, or attacker-resistant verification: they are compatibility algorithms, not safe password storage methods.
Frequently asked questions
Does this SHA-256 generator upload my text or file?
No. Text is encoded and hashed in the browser, and a selected file is read from the device by this browser tab. This tool has no server endpoint for the text, file, or checksum value.
Why does my SHA-256 hash differ from a command-line result?
Different bytes always produce a different SHA-256 digest. Check for a final newline added by `echo`, CRLF versus LF line endings, invisible spaces, a UTF-8 BOM, or a different text encoding. The 64-character hexadecimal SHA-256 value here is for the exact UTF-8 text shown.
How long is a SHA-256 hash?
A SHA-256 digest is always 256 bits, which is 32 bytes or 64 hexadecimal characters, whether the input is empty, one character, or a large file.
Can I use the MD5 generator for passwords?
No. MD5 produces a 128-bit, 32-character digest but has known collision weaknesses and is fast to guess. Use a password-hashing scheme designed for passwords, such as Argon2id, bcrypt, or scrypt, with a unique salt.
Can I compare an uppercase or colon-separated checksum?
Yes. The comparison ignores hexadecimal letter case, spaces, newlines, and colon separators, so a 64-character SHA-256 value copied as byte pairs can match the same lowercase uninterrupted digest.
Related tools
Updated 2026-10-16