Is my file uploaded to be hashed?

No. It is read and hashed inside the page, which is the whole point of doing it this way. You can watch the network panel during a hash and see that nothing is sent.

Why is MD5 still here if it is broken?

Because plenty of download pages still publish MD5 lines, and comparing against one is a reasonable way to spot a corrupted transfer. It is not a reasonable way to prove a file has not been tampered with, and the page says so next to the result.

Can I hash a password with this?

You can, and you should not store the result. Passwords need a slow algorithm built for the job, such as bcrypt, scrypt or Argon2, with a per-user salt. A bare SHA-256 of a password is cracked at billions of guesses a second.

My hash does not match the one on the website. What now?

Check you picked the same algorithm, then download the file again, since a truncated transfer is the usual cause. If it still differs after a clean download from the official source, do not run the file.

Hash Generator

Hash some text, or drop in a file to check it against the checksum its publisher listed. Five algorithms, all computed here, with nothing uploaded.

Algorithm

Your text

Compare with a published hashPaste the line from the download page. Capitals and spacing are ignored.

Runs entirely in your browser. Your files are never uploaded.

How to use Hash Generator

1Type text, or choose a file.
2Pick an algorithm.
3Paste the expected hash if you are verifying a download.
4Read the result, or the match.

Checking a download without uploading it

The usual reason to hash a file is to compare it with the line on the vendor's download page. Doing that through a website normally means uploading the file to a stranger's server, which is an odd thing to do with an installer you have not verified yet.

Here the file is read in the page and hashed on your own machine. Paste the published checksum into the comparison box and the answer comes back as a plain match or no match, with no request to anywhere.

Which algorithm to use

SHA-256 for anything new. It is the current default for checksums, signatures and content addressing, and SHA-384 or SHA-512 are there when something specifically asks for them.

MD5 and SHA-1 are both broken: a determined attacker can produce two different files with the same value, which has been demonstrated publicly for both. They are still everywhere in download pages and legacy systems, so they are offered here, flagged, for the one job they are still fit for, which is noticing that a file arrived corrupted.

Text is hashed as UTF-8

Hashing works on bytes, so text has to be turned into bytes first, and this page uses UTF-8. If a hash you are comparing against was computed from UTF-16 or Latin-1, or with a trailing newline that your paste does not have, the values will differ while the text looks identical.

Limits

100 MB per file, since the whole file is read into memory to hash it.
MD5 and SHA-1 are offered for compatibility and must not be used to prove anything.
Text is hashed as UTF-8 with no trailing newline added.
No HMAC and no salted password hashing, which need a key and a deliberate choice of algorithm.

Frequently asked questions

Is my file uploaded to be hashed?: No. It is read and hashed inside the page, which is the whole point of doing it this way. You can watch the network panel during a hash and see that nothing is sent.
Why is MD5 still here if it is broken?: Because plenty of download pages still publish MD5 lines, and comparing against one is a reasonable way to spot a corrupted transfer. It is not a reasonable way to prove a file has not been tampered with, and the page says so next to the result.
Can I hash a password with this?: You can, and you should not store the result. Passwords need a slow algorithm built for the job, such as bcrypt, scrypt or Argon2, with a per-user salt. A bare SHA-256 of a password is cracked at billions of guesses a second.
My hash does not match the one on the website. What now?: Check you picked the same algorithm, then download the file again, since a truncated transfer is the usual cause. If it still differs after a clean download from the official source, do not run the file.