Hash Generator

Four digests of the same bytes at once

Type text or choose a file and the SHA-1, SHA-256, SHA-384 and SHA-512 digests appear together in lowercase hex. Computing all four rather than making you pick means a value can be compared against whichever length the other side publishes, without guessing which algorithm made it.

Paste a published checksum in and the tool reports a match and names the algorithm that produced it — the length is what makes that possible, because no two rows above can be confused.

Text is converted to UTF-8 first, because a digest is taken over bytes, so the answer agrees with sha256sum and openssl dgst rather than with some other reading of the same characters.

This is the computing half of a pair. When you have a digest and no idea what made it, the hash identifier is the tool for that: it works the table above backwards, from a length to a shortlist of algorithms, and it computes nothing.

One worked digest, and what a single changed character does

The three letters abc hash under SHA-256 to ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, a published test vector, so any implementation disagreeing with it is broken. The empty input has a digest too, e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.

Add a full stop to a sentence and the digest is not nudged, it is replaced. Two 64-character strings with only a few coincidentally matching positions is the avalanche property working, and it is why a digest makes a good fingerprint: there is no near miss to interpret, only equal or not equal.

Length never varies with input. A single letter and a two-gigabyte disk image both leave SHA-256 as exactly 32 bytes, because the algorithm consumes fixed-size blocks into a fixed-size state.

Why MD5 is absent and SHA-1 carries a warning

Web Crypto, the browser API doing the work here, implements precisely these four. MD5 is not among them, which is a judgement rather than an oversight: producing two different inputs with the same MD5 has been practical since 2004, and a forged certificate built on exactly that was later found in the wild. Hand-writing one would mean shipping a broken tool for the sake of a complete menu.

SHA-1 is offered because real systems still use it — Git object names, older release checksums, some legacy protocols — but a collision was demonstrated in 2017 and a chosen-prefix collision in 2020, the variety that matters for forging a document. Treat it as an identifier, never a guarantee. SHA-384 and SHA-512 work on 64-bit words and are often faster on 64-bit hardware.

Checking a download, and the limit of that check

Comparing a file against the checksum on its download page is the common case, and a mismatch usually means a truncated transfer rather than anything sinister — re-fetching once is the right first move.

What the check proves is narrower than it looks. A checksum published beside the file only shows the two agree, and anyone able to replace the file could replace the number next to it. Protection against that is a signature verified against a key you already trust, which is why distributions publish a signed checksum file.

One trap catches everyone at least once: echo adds a trailing newline, so it hashes differently from the characters alone, and printf is what matches a digest taken here. Windows line endings do the same to a whole text file, turning every break into two bytes and every digest into a mismatch.

What a digest is not

It is not encryption. There is no key and no way back, so a digest cannot be decrypted, only guessed at — and short or common inputs are found instantly in a lookup table, so hashing an email address or a six-digit code hides nothing.

Passwords therefore need a deliberately slow, salted function such as Argon2id, scrypt or bcrypt, and proving a message came from you needs a keyed construction such as HMAC. Neither is what this generator computes. Everything happens on your own machine: no text or file selected here is uploaded, inspected by a server, or kept afterwards.