# Hash generator: SHA-256, MD5

How to use it

Type some text and its MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 appear at once, changing with every letter. The text is turned into UTF-8 bytes, so the result matches sha256sum, Python’s hashlib and friends when they get the same text without a trailing newline.

To hash a file, switch to “File” and drop it into the box. The browser reads it straight from your disk and uploads nothing, so large downloads are fine.

Checking a download

Many sites publish a checksum next to the download link, a line like SHA256: 9f86d0…. Paste it into “Compare with a hash”. If one of the hashes matches, its row turns green: the file is the same as the author’s, down to the last byte. Case, spaces and colons don’t matter for the comparison.

The avalanche effect

The second block holds the same text with one edit. The two squares are the bits of the two hashes; the red ones differ. For a good hash about half of them flip, and they tell you nothing about what changed in the text. That’s what makes a hash a fingerprint: similar texts get utterly different hashes.

FAQ

Can a hash be decrypted?

No. A hash isn’t a cipher but a fingerprint: you can’t get the text back from it, because it holds less information than the text. The only way to find the input is guessing: hash lots of candidates and compare. That’s how short passwords are cracked, as the lesson on hashes shows.

Which hash should I use?

For integrity checks and signatures, SHA-256 or SHA-512. MD5 and SHA-1 are broken: people can make two different files with the same hash. CRC32 is a checksum against accidental transmission errors and does nothing against deliberate tampering. None of these on their own is right for storing passwords: that needs a slow function such as bcrypt, scrypt or Argon2, with a salt.

Why isn’t the hash of an empty string empty?

A hash always has the same length, however many bytes go in. SHA-256 of the empty string starts with e3b0c442.

Is it safe to type a password here?

Everything runs in your browser and nothing is sent to the server. Still, pasting real passwords into web pages is a habit worth not having.