How do I verify a downloaded file with its SHA-256 checksum?

Choose the file with Hash a file, then compare the SHA-256 line with the value on the publisher's site. Every character must match; Uppercase hex only changes how the letters a to f are shown.

Can an MD5 or SHA-256 hash be decrypted?

No, there is nothing to decrypt. Sites that claim to reverse hashes look the digest up in tables of previously hashed strings, which works only for short or common inputs.

Why is MD5 still offered if it is broken?

Many systems still publish MD5 checksums, and it detects accidental changes perfectly well. It is broken only against an attacker who can deliberately craft colliding files.

What is the MD5 hash of an empty string?

d41d8cd98f00b204e9800998ecf8427e. Seeing this value usually means a program hashed nothing, for example because a file failed to load before the hash ran.

Is SHA-512 more secure than SHA-256?

Both are unbroken and far beyond brute force. SHA-512 has a longer output and can be faster on 64-bit processors, but SHA-256 is the more widely expected choice for checksums and signatures.

Hash Generator

Type text or choose a file and get its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests side by side, each with its own copy button. Hashing runs on your device with the browser's Web Crypto API and a local MD5 routine, so files are never uploaded.

Uppercase hex

Input

0 characters · 0 words · 0 lines

Hash a file

Result

MD5not for security: —
SHA-1not for security: —
SHA-256: —
SHA-384: —
SHA-512: —

0 characters · 0 words · 0 lines

Runs entirely in this browser tab. Your text is never uploaded or stored.

Digest sizes

Lengths and empty-input digests were computed with this page's own MD5 and the Web Crypto API when the page was built.

Algorithm	Digest bits	Hex length	Block bits	Status	Hash of empty input
MD5	128	32	512	Broken: collisions found in 2004	`d41d8cd98f00b204e9800998ecf8427e`
SHA-1	160	40	512	Broken: collision shown in 2017	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA-256	256	64	512	Secure (SHA-2)	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA-384	384	96	1024	Secure (SHA-2)	`38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b`
SHA-512	512	128	1024	Secure (SHA-2)	`cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e`

Five algorithms, two of them retired

A hash function turns input of any size into a fixed-size fingerprint. Change a single character and roughly half the output bits flip, so even "UltKit" and "ultkit" produce unrelated digests. MD5, published by Ron Rivest in RFC 1321 in 1992, gives 128 bits (32 hex characters). In 2004 Xiaoyun Wang and colleagues showed how to build two different inputs with the same MD5 hash, and by 2012 the Flame malware used an MD5 collision to forge a Microsoft code-signing certificate. SHA-1 (160 bits) fell the same way when Google and CWI Amsterdam published the first real collision, SHAttered, in 2017. Both are labeled "not for security" here.

SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family, specified by NIST in FIPS 180-4, and no practical attack on them is known. SHA-256 is the default for software downloads, Git's newer object format, TLS certificates and Bitcoin. MD5 and SHA-1 remain fine for non-adversarial jobs such as spotting accidental corruption or deduplicating files, which is why many download pages still list them.

Why hashing is not encryption

Encryption is reversible by design: whoever holds the key gets the original back. A hash has no key and cannot be reversed, because countless inputs map to every digest. That does not make a hash a safe container for secrets. An attacker who sees the SHA-256 of a short or common input simply hashes candidates until one matches, and precomputed tables cover billions of known passwords. Fast hashes are built to be fast, and modern GPUs try billions of SHA-256 guesses per second.

So store passwords with a deliberately slow, salted password hash such as Argon2, bcrypt or scrypt, never with plain MD5 or SHA-256, and create the passwords themselves with a password generator. Use this page for what fast hashes do well: verifying that a downloaded file matches the checksum its publisher lists, comparing two files without opening them, or checking a digest your own code computed. Text is hashed as UTF-8 without a trailing newline, which is the usual reason a result differs from echo "text" | sha256sum in a terminal. The developer tools hub compares hashing with reversible encodings on one sample.

Frequently asked questions

How do I verify a downloaded file with its SHA-256 checksum?: Choose the file with Hash a file, then compare the SHA-256 line with the value on the publisher's site. Every character must match; Uppercase hex only changes how the letters a to f are shown.
Can an MD5 or SHA-256 hash be decrypted?: No, there is nothing to decrypt. Sites that claim to reverse hashes look the digest up in tables of previously hashed strings, which works only for short or common inputs.
Why is MD5 still offered if it is broken?: Many systems still publish MD5 checksums, and it detects accidental changes perfectly well. It is broken only against an attacker who can deliberately craft colliding files.
What is the MD5 hash of an empty string?: d41d8cd98f00b204e9800998ecf8427e. Seeing this value usually means a program hashed nothing, for example because a file failed to load before the hash ran.
Is SHA-512 more secure than SHA-256?: Both are unbroken and far beyond brute force. SHA-512 has a longer output and can be faster on 64-bit processors, but SHA-256 is the more widely expected choice for checksums and signatures.