Hash generator

A cryptographic hash turns any input into a fixed-length fingerprint. The same input always produces the same output, a one-character change produces a completely different one, and working backwards from the hash to the input is computationally infeasible.

Verifying a download

Projects publish the SHA-256 of their release files. Hash the file you downloaded and compare: a match means the bytes are exactly what was published, ruling out both corruption and tampering in transit. Paste the published checksum above and the tool will tell you which algorithm it matches.

SHA-1 and MD5 are broken

Both have practical collision attacks — Google demonstrated a SHA-1 collision on two different PDFs in 2017. SHA-1 is included here because legacy systems still use it, not because it should be chosen for anything new. MD5 is not offered at all; browsers do not implement it in Web Crypto, which is a reasonable signal.

Do not hash passwords with these

SHA-256 is designed to be fast, which is exactly wrong for password storage — it lets an attacker try billions of guesses per second. Password hashing needs a deliberately slow, salted algorithm: Argon2id, scrypt or bcrypt.