Hash and Checksum Generator

How to use it

1. 1Paste your text into the box marked "Text to hash"Paste the text or value you want a digest of. Everything happens inside your browser — nothing is uploaded, so there is nothing for us to store, log or lose.
2. 2Read the result as it updatesThere is no button to press. Digests appear for every algorithm at once. The output recomputes every time you change the text or one of the options above it.
3. 3Pick the right algorithm for the jobSHA-256 for anything that matters. MD5 and SHA-1 are here because real files still ship with them, not because you should choose them — both are broken for anything security-related.
4. 4Use "Show as" to match the format you were givenHex and Base64 are the same digest written differently. A checksum that "does not match" is very often the same value in the other encoding.
5. 5Paste a checksum to compare itThe comparison box takes the value you were given and tells you whether it matches, without you having to read two long strings character by character — which is exactly the check people get wrong by eye.
6. 6Note that this hashes text, not filesFor verifying a downloaded file, your operating system's own checksum command is the right instrument.
7. 7Copy or download the resultThe buttons under the output put it on your clipboard or save it as a file, and each one says exactly what it will copy or download. Any note about something the tool changed or deliberately left alone is shown with the result rather than hidden.

About this tool

A cryptographic hash reduces any input to a fixed-length fingerprint. The same input always gives the same digest, and changing a single bit changes the digest completely — which is what makes hashes useful for verifying that a file or a message arrived intact.

This tool uses the browser's own Web Crypto implementation, so the digests are computed by audited platform code rather than by JavaScript we wrote. It also compares a digest against a checksum you paste, because "does my copy match the published one?" is the actual question most people arrive with.

Understanding the result

Text is encoded as UTF-8 before hashing. Two tools that disagree about a digest for the same visible characters are almost always disagreeing about the encoding, not the algorithm.

Digests are shown in hexadecimal and Base64. Both represent the same bytes; vendors publish sometimes one and sometimes the other.

The comparison accepts a checksum in either form and tells you which algorithm matched — useful because people are often given a checksum without being told which algorithm produced it.

Example

roftrlabs

SHA-256: 6d2a1a…  (64 hex characters, 256 bits)

Limitations

• MD5 is not offered. It is absent from the Web Crypto API, so providing it would mean shipping a third-party implementation to every visitor in order to compute a hash broken since 2004. For a vendor-published MD5, use md5sum or certutil -hashfile.
• SHA-1 is offered but labelled broken. Use it to check an existing checksum or a Git object, never to protect anything.
• A plain hash is the wrong tool for storing passwords. Password hashing needs a deliberately slow algorithm with a salt — bcrypt, scrypt or Argon2 — and a fast hash makes brute force easy.
• This hashes text you paste, not files. File hashing is a separate tool.
• Hashing requires a secure context. On plain HTTP the browser withholds crypto.subtle entirely, and the page says so rather than showing nothing.

Questions