SHA Hash Generator
Produce cryptographic hashes of text or of any file on your device. Useful for verifying a download checksum or comparing two files byte for byte.
Or hash a file
Hashes are computed by the Web Crypto API built into your browser, so even multi-megabyte files never leave your device. MD5 is deliberately omitted: it has been broken for collision resistance since 2004 and browsers do not implement it. Use SHA-256 for checksums.
Frequently Asked Questions
Why is MD5 not offered?
Because it is broken. Practical collision attacks against MD5 have existed since 2004, and browsers deliberately do not implement it in the Web Crypto API. Use SHA-256 for anything that matters.
How do I verify a downloaded file?
Drop the file into the box above and compare the SHA-256 output against the checksum published by whoever distributed it. If even one byte differs, the hash will be completely different.
Is my file uploaded to check the hash?
No. The file is read into memory by your browser and hashed by the Web Crypto API on your own device. It never touches the network, which is exactly why this is safe for sensitive files.
Should I hash passwords with SHA-256?
No. Password storage needs a slow, salted algorithm such as bcrypt, scrypt or Argon2. SHA-256 is designed to be fast, which is the opposite of what you want when resisting brute-force attacks.