Hash Calculator

A hash function takes any input (text, file, data) and produces a fixed-length string of characters called a digest or hash. The same input always produces the same hash, but even a tiny change in the input produces a completely different hash. This makes hashes useful for verifying data integrity.

They differ in output length and security strength. MD5 produces a 128-bit (32 hex characters) hash and is considered broken for security use — avoid it for passwords or signatures. SHA-1 (160-bit) is also deprecated. SHA-256 (256-bit) and SHA-512 (512-bit) are current standards — use SHA-256 for most purposes and SHA-512 when maximum collision resistance is needed.

No. MD5 and SHA-1 are fast and reversible via rainbow tables — they have been broken for password storage. For passwords, use a dedicated algorithm like bcrypt, scrypt, or Argon2. For data integrity checks (verifying a file download), MD5 is still practical even though it's cryptographically weak.

The File Hash tab reads your entire file directly in the browser using the File API, converts it to a byte array, and runs each hash algorithm over the raw bytes. The file never leaves your device. This is the same process used by tools like md5sum and sha256sum on the command line.

SHA-256 is the most widely used hash algorithm today. It is used by Bitcoin and other cryptocurrencies, TLS/HTTPS certificates, code signing, software integrity verification, JWT tokens, and HMAC authentication. When in doubt about which algorithm to use, SHA-256 is the safe choice.

Hash functions are deterministic — the same input always maps to the same output. This is by design: it lets you verify that data has not been modified by comparing hashes. However, two different inputs should never produce the same hash (called a collision). For MD5 and SHA-1, collisions have been demonstrated, which is why they are deprecated for security-critical use.