AnyFormat

00 Utility

Hash Generator

Every algorithm at once, from text or a dropped file.

01Text
03Options 1
  • No upload The conversion runs in this tab. Your file never travels — not to us, and not to the advertising.
  • No sign-up, no email, no daily cap There is no account system to sign up to.
  • No size limit we invented Only your device's memory — about ~2 GB on a desktop browser, ~400 MB on a phone.
  • Turn your Wi-Fi off and convert anyway The conversion needs nothing but this page. Ads will not load without a connection; your file will still convert. That is the whole claim, and it takes five seconds to check.

Computes every common hash at once, from typed text or a dropped file. Showing them all together is deliberate: you usually have a checksum to compare against and do not know which algorithm produced it, and its length tells you immediately.

Identifying a checksum by its length

8 hex characters — CRC32. Not a hash at all, an error-detecting code. Used inside ZIP and PNG.

32 — MD5. Broken for security since 2004 but still ubiquitous for file integrity.

40 — SHA-1. Broken for collisions since 2017. Git uses it, though not for security.

64 — SHA-256. The current default for essentially everything.

96 — SHA-384. 128 — SHA-512.

Verifying a download

Drop the downloaded file here and compare the result with the checksum the publisher gives. This is worth doing for installers, disk images and anything from a mirror, and it works on files of any size — the file is read in chunks rather than loaded whole, so a 4 GB ISO is fine.

Note what this proves and what it does not. A matching checksum proves the bytes match what the publisher's page said. It does not prove the publisher's page was not itself tampered with. For that you need a signature, not a hash.

Do not use these to store passwords

MD5, SHA-1 and the SHA-2 family are designed to be fast, which is exactly wrong for password storage — a modern GPU computes billions of SHA-256 hashes per second. Password hashing needs a deliberately slow, memory-hard algorithm with a per-user salt: Argon2id, scrypt or bcrypt. "Hashed with SHA-256" in a breach disclosure means the passwords are effectively plaintext.

Why MD5 is still here

Because it remains genuinely useful for detecting accidental corruption, and because a great deal of existing infrastructure emits it. It is broken against a deliberate attacker — two different files with the same MD5 can be constructed in seconds — but a truncated download will not produce a matching MD5 by chance.

Other names for this

Also searched as “md5 generator”, “sha256 generator”, “checksum calculator”, “sha1 hash”.

Questions

Which algorithm should I use?
SHA-256 unless something specific requires otherwise. Use MD5 or CRC32 only to check for accidental corruption, never against an adversary.
Can I hash a large file?
Yes. Files are read in chunks, so multi-gigabyte files work without exhausting memory.
Why do I get a different hash for the same text?
Almost always a trailing newline, or CRLF versus LF line endings. Hashes are exact — one byte of difference changes everything.
Can it reverse a hash?
No, and nothing can. Hashing is one-way. Services that claim to "decrypt MD5" are looking the value up in a table of pre-computed common inputs.
Does my text leave the browser?
No. Everything runs as JavaScript in this tab — there is no server involved and no request is made. Open the Network panel and watch, or turn your Wi-Fi off and keep using the tool.