DevWhat a hash is for
Hashing is the closest thing computing has to a fingerprint kit. Feed in anything — a password candidate, a downloaded ISO, a database row — and out comes a fixed-length string of hex that depends on every single bit of the input. Recompute it later on the same data and you get the same string, bit for bit; change one byte anywhere and the result is unrecognisably different. That gives you a primitive that shows up everywhere: verify a download against the publisher's checksum before you run it; detect that two files are identical without comparing them byte by byte; build content-addressed storage, where the hash is the address (Git works this way); and commit to a value — publish its hash today, reveal the value later — without leaking anything about it. This page computes the four digests you will meet most often, live as you type, using your browser's own cryptography for the SHA family.
How to use this tool
- Type or paste the text. All four digests update as you type — there is no button, because there is nothing to send anywhere.
- Compare carefully. A digest is only useful compared bit-for-bit against a reference value from a trustworthy source; eyeballing the first few characters is how people end up trusting the wrong file.
- Copy the digest you need with its row's button. Digests are shown in lowercase hex, the conventional form; if a tool expects uppercase, it will usually accept lowercase too — the value is the same.
- Mind the encoding: the input is hashed as UTF-8 text. A checksum published for a file covers the file's bytes, which for a text file include its line endings — hashing the same words typed here and stored in a file with Windows line endings gives different digests, correctly.
The four algorithms, honestly labelled
MD5 (1992) produces 128 bits and was the web's default checksum for a decade. Collisions — two inputs with the same digest — have been practical since 2004 and cheap since the 2010s, so MD5 is finished anywhere security is claimed. It survives, legitimately, as a corruption check and a legacy fingerprint, which is why it is here, badged as such. SHA-1 (1995) produces 160 bits and fell in 2017, when Google published two different PDFs with the same SHA-1 digest (the SHAttered attack); browsers and Git hosts have been migrating off it since. You will still meet it in Git commit IDs and old release notes. SHA-256 (2001) is the current workhorse — 256 bits, no practical attacks, the digest behind TLS certificates, Bitcoin and most published checksums today; when in doubt, this is the one to use. SHA-512 is its larger sibling: 512 bits, and on 64-bit hardware often faster per byte than SHA-256 because it works on 64-bit words. Length is not automatically better — a truncated SHA-512 can be the right engineering choice — but for a plain file fingerprint either is beyond brute force.
What hashing is not
A hash is not encryption: there is no key and no way back, by design — anything that can be "decrypted" is not a hash. It is not a password scheme by itself, for the reasons in the FAQ: fast and unsalted is precisely what an attacker wants. And a matching checksum proves only that the bytes you received are the bytes the checksum describes — if you fetched both the file and its checksum from the same compromised place, the check proves nothing. The value of a digest is exactly the trustworthiness of the channel you got the digest through. Used with that in mind, these four little hex strings are among the most reliable tools in all of computing.