Paste text or choose a file to calculate its MD5, SHA-1, SHA-256 and SHA-512 digests at once. The file is read by your browser and never uploaded, which makes this safe for private documents, installers and configuration backups.
Input
MD5
—SHA-1
—SHA-256
—SHA-512
—Which hash should you use?
Use SHA-256 or SHA-512 whenever the hash is a security decision: download verification, signatures, password-derived keys or integrity checks that an attacker might want to forge. Both are collision-resistant and widely supported. SHA-512 is faster on 64-bit CPUs but produces a longer digest.
MD5 and SHA-1 are still common in legacy manifests, checksums from older vendors and non-security checks such as cache keys. They are broken for collision resistance, so never use them to prove that a file is authentic. If a vendor site only publishes an MD5, treat it as a typo check rather than a security control.
For passwords, do not use any of these hashes directly. Password storage needs a slow, salted key-derivation function such as Argon2id, scrypt or bcrypt, not a fast digest.
Checking a downloaded file
Hash the file you downloaded, then compare the digest with the one published by the vendor. Compare the entire string, not a prefix. If the vendor publishes the hash over HTTPS and you downloaded over HTTPS, matching digests mean the bytes arrived intact; they do not prove that the vendor's own server was not compromised.
MD5 runs in JavaScript; SHA-1, SHA-256 and SHA-512 use the browser's Web Crypto API and require HTTPS. Very large files can take a few seconds to read and hash.