tigtools

Hash Generator

Get MD5 and SHA hashes of any text or file, and compare them with an expected checksum. Files are read on your device and never uploaded.

Runs in your browser No sign-up

Input type

Hashed as UTF-8 exactly as typed, including spaces and line breaks.

Output format
  • MD5Not suitable for security
    —
  • SHA-1Not suitable for security
    —
  • SHA-256
    —
  • SHA-384
    —
  • SHA-512
    —

Paste a checksum from a download page. Hex is compared without regard to case, spaces or colons; Base64 is also accepted.

How to use it

  1. Choose Text and type or paste your text, or choose File and pick or drop a file.
  2. Read the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 values. Switch between lowercase hex, uppercase hex and Base64.
  3. To verify a download, paste the checksum published by the provider into the compare box. The matching algorithm is highlighted.
  4. Copy a single hash, or use “Copy all” to copy every hash with its algorithm name.

How it works

A hash function turns any input into a fixed-length fingerprint. The same input always gives the same hash, and changing a single bit changes the result completely, which makes hashes useful for checking that a file was downloaded without corruption or tampering.

SHA-1, SHA-256, SHA-384 and SHA-512 are computed with your browser's built-in Web Crypto API. MD5 is not available in Web Crypto, so this page includes its own implementation of RFC 1321, checked against the standard test vectors. Text is converted to UTF-8 bytes before hashing, so “é” is hashed as two bytes, and a trailing space or line break changes the result.

MD5 and SHA-1 are broken for security purposes: researchers can create two different inputs with the same hash. They are still fine for detecting accidental corruption and for matching checksums that a provider publishes, but do not use them for signatures or certificates. Do not use any plain hash to store passwords; use a slow password hash such as Argon2, scrypt or bcrypt.

Files up to 200 MB are read into memory. MD5 is calculated in chunks with short pauses so the page stays responsive, and a progress message is shown. Very large files can take several seconds on phones.

Examples

Verifying a downloaded ISO

A Linux download page lists a SHA-256 checksum. Choose File, drop the .iso, paste the published value into the compare box, and look for “Match: … SHA-256”. A mismatch means the file is incomplete or not the original.

A well-known test value

The text “abc” has the MD5 hash 900150983cd24fb0d6963f7d28e17f72 and the SHA-256 hash ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Use it to check another tool gives the same results.

Base64 for HTTP headers

Subresource Integrity and some APIs expect a SHA-256 or SHA-384 hash in Base64 rather than hex. Switch the output format to Base64 and copy the SHA-384 value.

Frequently asked questions

Why does my hash differ from another tool's result for the same text?

Usually the input differs invisibly: a trailing newline, Windows line endings (CRLF), a different text encoding or a leading space. This tool hashes exactly the UTF-8 bytes of what is in the box.

Can a hash be reversed to get the original text?

No. Hash functions are one-way. Short or common inputs can still be found by trying guesses, which is why passwords need a slow, salted password-hashing algorithm instead of a plain hash.

Is MD5 still safe to use?

Not for security. MD5 and SHA-1 collisions can be produced on purpose, so they must not protect against deliberate tampering. For integrity checks against accidental damage they still work, but SHA-256 is the better default.

Are my files uploaded?

No. Files are read with the browser's File API and hashed in this tab. Nothing is sent to a server, and the page works offline once loaded.

What is the largest file I can hash?

200 MB. The whole file is loaded into memory, so larger files could exhaust memory on phones and older computers. For bigger files, use a command-line tool such as sha256sum or certutil.

Privacy

Text and files are hashed in your browser and never uploaded. Neither the input nor the hashes are stored or sent to analytics; only an anonymous event that the tool was used is recorded.