MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, worked out in your browser. The file never leaves your machine.
A hash function turns any input into a short fixed-length value. The same input always gives the same value, and changing one bit of the input changes the value completely. That makes a hash a fingerprint: if two files have the same SHA-256, they are the same file.
The usual job is checking a download. A vendor publishes the checksum of an installer or a firmware image. You hash the file you received and compare. Choose the file above, paste the published checksum into the compare box and the page says whether they match. The check is only as good as the place the published checksum came from, so take it from the vendor's own HTTPS site and not from the mirror that served the file.
SHA-256 is the one to use by default. It belongs to the SHA-2 family in FIPS 180-4, along with SHA-384 and SHA-512, and no practical attack on it is known.
MD5 and SHA-1 are broken for security use. Two different inputs with the same MD5 can be made in seconds, and a SHA-1 collision was demonstrated in 2017. They are still fine for spotting accidental corruption, and they are here because old systems and download pages still publish them. Do not accept either as proof that a file has not been tampered with.
None of these is a way to store passwords. They are built to be fast, and fast is what an attacker with a stolen database wants. Password storage needs a deliberately slow function with a salt, such as Argon2id, bcrypt, scrypt or PBKDF2, as the OWASP Password Storage Cheat Sheet sets out. If your cryptography policy names approved algorithms, that distinction belongs in it.
The text and the file are read by your browser and hashed on your device. The
SHA values come from the browser's own Web Crypto API and MD5 from the script
on this page. Files up to 200 MB are handled. For larger ones use
sha256sum on Linux, shasum -a 256 on macOS or
certutil -hashfile on Windows.
Choose the file, then paste the checksum the publisher gives into the compare box. The tool works out which algorithm it is from its length and tells you whether the file matches. A mismatch means the file is corrupt, incomplete or not the one the publisher released.
No. The file is read and hashed by your browser on your own device. Nothing about it, including its name, is sent to us.
For detecting accidental corruption, yes. For security, no: different files with the same MD5 can be created on purpose. Use SHA-256 whenever the question is whether someone has tampered with a file.
Not by calculation. A hash can be guessed, though: common words and passwords have been hashed in advance, so the hash of a weak password is found by lookup. That is why passwords need a slow, salted function and not a plain hash.
Almost always an invisible difference: a trailing newline, a space, or a different text encoding. This tool hashes exactly the characters in the box, encoded as UTF-8, with nothing added.