Hash generator — MD5, SHA-1, SHA-256, SHA-512

How to use it

1. Type text, or pick a file to hash it byte for byte.
2. All four hashes are computed at once; copy the one you need.
3. To verify a download, paste the published checksum into the compare box — a match is confirmed for you.

A matching checksum proves less than people assume

Comparing a digest proves your bytes are the bytes whose digest you were handed. It says nothing about who produced that digest. When the checksum sits on the same page as the download, anyone able to replace the file can replace the string beneath it. Distributions publish detached GPG signatures for that reason: a signature binds the digest to a key obtainable elsewhere, a bare hex string binds it to nothing.

Deliberate collisions are where the algorithm choice bites. In 2017 the SHAttered team published two PDFs with identical SHA-1 digests; by 2020 a chosen-prefix collision — where an attacker controls meaningful content on both sides — was costed at around $45,000 of rented compute. Flame used a chosen-prefix MD5 collision to forge a code-signing certificate chaining to Microsoft. Web Crypto’s digest offers the SHA family only; MD5 was never in that specification.

Why a digest is the wrong tool for storing a password

SHA-256 is engineered to be fast, which disqualifies it for passwords. A single consumer GPU computes billions of SHA-256 digests per second, so an unsalted digest of a human-chosen password behaves less like a secret than a lookup key. Password storage needs a deliberately slow, memory-hard function with a per-user salt — Argon2id is the current recommendation, with scrypt and bcrypt still acceptable.

The same distinction rules out using a plain digest as a message authentication code. Appending a secret to a message and hashing it is vulnerable to length extension against Merkle-Damgard constructions, SHA-256 among them: an attacker who never learns the key can still append data and produce an accepted digest. HMAC closes that gap. What is computed here is unkeyed digests only — no HMAC, no salt, no key derivation.

Questions