MD5, SHA-1, and SHA-256 are selected by default. SHA-3 and RIPEMD-160 use the page's optional client-side crypto library when it is available.
Files are processed locally in your browser and are not uploaded.
HMAC supports SHA-1, SHA-256, SHA-384, and SHA-512 through the Web Crypto API.
Whitespace, colons, and hyphens are ignored for hex comparisons.
Tip: Ctrl/Cmd + Enter regenerates hashes. Ctrl/Cmd + K focuses the text box.
For modern integrity checks, choose SHA-256 or SHA-512. They are widely supported by command-line tools, APIs, package managers, and checksum files.
MD5 and SHA-1 are legacy algorithms. Use them only when you need compatibility with an existing checksum, and not for adversarial security decisions.
A hash is not encryption. It cannot be decrypted, and plain hashes are not appropriate password storage. For passwords, use a dedicated password hashing function such as bcrypt, Argon2, or scrypt.
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA-1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA-512: cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
MD5: 5d41402abc4b2a76b9719d911017c592
SHA-1: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-512: 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043
Publishers often list a SHA-256 checksum next to a download. Hash the file or sample text, paste the expected checksum, and look for a match.
Expected SHA-256 for hello: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
| Algorithm | Digest length | Hex characters | Security status | Common uses | When not to use it |
|---|---|---|---|---|---|
| MD5 | 128-bit | 32 | Broken for collision resistance | Legacy checksums, old systems | Security, signatures, passwords, tamper-resistant integrity |
| SHA-1 | 160-bit | 40 | Deprecated for security | Legacy Git and checksum compatibility | New security-sensitive designs |
| SHA-256 | 256-bit | 64 | Modern general-purpose choice | Downloads, APIs, package checksums, signatures | Password storage without bcrypt, Argon2, or scrypt |
| SHA-512 | 512-bit | 128 | Modern and strong | High-assurance integrity, 64-bit systems | Short fixed-width fields that require SHA-256 compatibility |
| SHA-3 | 224-512-bit | 56-128 | Modern SHA-3 family | Systems that specify Keccak/SHA-3 outputs | When the receiving system expects SHA-2 |
| CRC32 | 32-bit | 8 | Checksum only, not cryptographic | Archives, accidental corruption checks | Any adversarial or security-sensitive check |
| HMAC | Depends on selected SHA algorithm | Depends on selected SHA algorithm | Secure when key and SHA choice are strong | Webhook signatures, API authentication, message integrity | Public checksums where no secret key is shared |
A cryptographic hash function maps text or bytes to a fixed-size digest. The same input produces the same output, but a strong hash should make it impractical to reconstruct the input or find a different input with the same digest.
This page hashes text and files in the browser. SHA-1, SHA-256, SHA-384, SHA-512, and HMAC use the browser Web Crypto API where supported. MD5, SHA-224, SHA-3, and RIPEMD-160 use the client-side library loaded by the page when available. CRC32 and Adler32 are checksum calculations implemented locally in JavaScript.
No. Encryption is designed to be reversible with a key. A hash is a one-way digest used for fingerprints, checksums, and integrity checks.
No. Hashes are designed to be one-way. Weak or common inputs can sometimes be guessed with dictionaries, but the digest itself is not decrypted.
Different input encoding, invisible whitespace, line endings, Unicode normalization, uppercase versus lowercase output, HMAC mode, or hashing the text of a file path instead of the file bytes can all change the result.
Use MD5 only for legacy compatibility or non-adversarial checksums. Do not use MD5 for signatures, security decisions, password storage, or tamper-resistant integrity checks.
Drop the downloaded file into the file hashing area, choose the algorithm listed by the publisher, paste the expected checksum into the compare field, and check for a match.
HMAC combines a cryptographic hash with a secret key. It is used to verify that a message came from someone who knows the key and was not changed.
SHA-256 produces a 256-bit digest and SHA-512 produces a 512-bit digest. Both are modern SHA-2 algorithms; SHA-512 has a longer output and can be faster on some 64-bit systems.
No. Files are read and hashed locally in your browser. The file bytes are not uploaded to Starlight Tools.
