What is the difference between MD5, SHA-1, SHA-256 and SHA-512?

MD5 produces 128 bits and SHA-1 produces 160 bits; both have practical collision attacks and should not be used where an attacker might try to forge a match. SHA-256 produces 256 bits and is the current general-purpose standard. SHA-512 produces 512 bits and is often faster than SHA-256 on 64-bit hardware.

Is this hash calculator safe to use with sensitive data?

All hashing runs locally in your browser. Your text or file is never transmitted to any server, stored, or shared. You can confirm this by opening your browser's network tab while hashing.

Hash Calculator Online Free

Generate MD5, SHA-1, SHA-256 and SHA-512 hashes from text or files. Large files are hashed in chunks with a progress bar, so nothing has to fit in memory at once. Everything runs in your browser.
No upload · Checksum verification · Works offline

Enter text or a string

Hash algorithms

MD5 (not collision-safe) SHA-1 (not collision-safe) SHA-256 SHA-512

Live update while typing (text only)

Paste the expected hash (from a download page or a sha256sum line):

How It Works

1. Enter Text or File

Type text, or switch to File mode to hash a file from your device.

2. Choose Algorithms

Pick any combination of MD5, SHA-1, SHA-256 and SHA-512.

3. Compute Locally

Hashing runs in your browser. Files are processed in chunks with progress.

4. Copy or Verify

Copy a hash, or paste an expected checksum to check it matches.

What Is a Hash Calculator?

A hash calculator turns any input — a string of text or an entire file — into a fixed-length hexadecimal fingerprint. The same input always produces the same output, and changing a single byte produces a completely different result. That property is what makes hashes useful for checking that a file downloaded correctly, or that a document hasn't been altered.

This calculator runs entirely in your browser, so the text or file you hash is never transmitted anywhere. That matters when the input is a private document, an API key or a contract.

Algorithm comparison

Algorithm	Output	Collision resistance	Reasonable uses
MD5	128-bit (32 hex)	Broken	Non-adversarial checksums, deduplication, legacy systems
SHA-1	160-bit (40 hex)	Broken	Git object IDs, legacy compatibility
SHA-256	256-bit (64 hex)	Secure	File integrity, certificates, signatures, general use
SHA-512	512-bit (128 hex)	Secure	Same as SHA-256; often faster on 64-bit hardware

"Broken" here means practical collision attacks exist — someone can construct two different inputs with the same hash. That matters when an attacker might try to substitute one file for another. It does not mean MD5 is useless for spotting accidental corruption in a download.

Do not use these to store passwords

MD5, SHA-1, SHA-256 and SHA-512 are all designed to be fast, which is exactly what makes them the wrong tool for passwords: a modern GPU can try billions of guesses per second against a fast hash. Passwords should be stored with a deliberately slow, salted key derivation function — Argon2id, scrypt, bcrypt, or PBKDF2 with a high iteration count. This applies to SHA-512 just as much as to MD5; extra output length does not help.

How to Verify a Download

This is the most common reason to reach for a hash calculator:

Find the published checksum. Most software projects list a SHA-256 value beside the download link, or ship a SHA256SUMS file.
Hash your copy. Switch to the File tab, choose your downloaded file, tick SHA-256 and click Generate Hashes.
Compare. Open Compare / verify a hash and paste the published value. You can paste a whole sha256sum line — the tool takes the hash from it. It will tell you which algorithm matched.

A match means your copy is byte-for-byte identical to the one the publisher hashed. A mismatch means the download is corrupt, incomplete, or a different version — re-download before running it.

One caveat worth understanding: a checksum only proves your file matches what the publisher published. If an attacker can alter the download and the checksum on the same page, both will agree. That's why signed releases (GPG, code signing) exist for higher-stakes verification.

Other Common Uses

Deduplication: identical hashes mean identical files, which is far cheaper than comparing bytes across a large collection.
Change detection: hash a config file or document now, compare later to see whether anything was modified.
Transfer verification: hash before and after moving files between systems to confirm nothing was corrupted in transit.
Development and debugging: check what hash a given string produces when integrating with an API that expects one.
Digital forensics: record hashes of evidence files to demonstrate they haven't changed since collection.

Frequently Asked Questions

What is a hash calculator?

It generates a fixed-length fingerprint from any input. MD5 gives 32 hex characters, SHA-1 gives 40, SHA-256 gives 64 and SHA-512 gives 128. The same input always produces the same hash, and a one-character change produces a completely different one.

How do I generate an MD5 hash from text?

Select the Text tab, type or paste your input, make sure MD5 is ticked, then click Generate Hashes. Tick Live update to watch it change as you type. Nothing is sent to a server.

Can I hash a large file?

Yes. The file is read and hashed in 4 MB chunks with a progress bar, so it doesn't all have to fit in memory — a multi-gigabyte file works. It does take time, because hashing runs in JavaScript on your own machine, and you can cancel at any point. Fewer algorithms ticked means faster hashing.

Should I use SHA-512 to hash passwords?

No. All four algorithms here are built for speed, which is precisely why they're unsuitable for password storage — a GPU can test billions of candidates per second. Use a slow, salted key derivation function instead: Argon2id, scrypt, bcrypt, or PBKDF2 with a high iteration count. A longer hash doesn't help here.

What's the difference between MD5, SHA-1, SHA-256 and SHA-512?

MD5 (128-bit) and SHA-1 (160-bit) both have practical collision attacks — don't rely on them where someone might try to forge a match, though they're fine for spotting accidental corruption. SHA-256 (256-bit) is the current general-purpose standard. SHA-512 (512-bit) is equally secure and often faster on 64-bit hardware.

Is it safe to use with sensitive data?

All hashing happens locally in your browser — your text or file is never transmitted, stored or shared. Open your browser's network tab while hashing and you'll see no request carrying your data.