MD5Legacy
Generate a hash to see the result.
Hash Generator for Text and Files
Calculate MD5, SHA-1, SHA-256, and SHA-512 digests without uploading your text or file. Copy results as hexadecimal or Base64 and compare checksums safely.
Generate four common hashes
Processing happens locally. Selected files are read into browser memory and are not sent to MiniUtils.
Security note: MD5 and SHA-1 are included for legacy checksum compatibility. Do not use them for signatures, certificates, password storage, or new collision-resistant designs.
SHA-1Legacy
Generate a hash to see the result.
SHA-256Recommended checksum
Generate a hash to see the result.
SHA-512Strong digest
Generate a hash to see the result.
What a hash generator does
A cryptographic hash function turns a sequence of bytes into a fixed-length digest. The same bytes processed with the same algorithm produce the same digest. Changing even one byte normally creates a very different-looking result. Hashing is one-way in practical use: a digest is not an encrypted copy that can simply be decoded back into the original file or message.
This makes hashes useful for integrity checks. A software publisher can list a SHA-256 digest beside a download. After downloading, you calculate the file’s digest and compare every character with the publisher’s trusted value. A match gives evidence that the bytes you received are the same bytes represented by that checksum. It does not prove that the publisher or original file was trustworthy.
SHA-256(“hello”) = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824Understanding the four algorithms
MD5
MD5 produces a 128-bit digest, usually shown as 32 hexadecimal characters. It remains common in old download lists, deduplication systems, and non-adversarial file inventories. Practical collision attacks mean two different inputs can be deliberately created with the same MD5 value, so it is unsuitable when an attacker could influence the files.
SHA-1
SHA-1 produces a 160-bit digest shown as 40 hexadecimal characters. It is also collision-broken and has been retired from many security protocols. Use it only to compare with an existing SHA-1 checksum or support a legacy workflow that cannot yet be changed.
SHA-256
SHA-256 is part of the SHA-2 family and produces a 256-bit digest, or 64 hexadecimal characters. It is a practical default for modern file checksums and general integrity comparisons. A digest is not automatically a digital signature: anyone who can replace a file may also be able to replace an unprotected checksum displayed beside it.
SHA-512
SHA-512 is another SHA-2 function and produces a 512-bit digest, shown as 128 hexadecimal characters. It can be useful where a protocol or manifest explicitly requires SHA-512. A longer digest does not repair a weak trust process; the expected value must still come from an authentic source.
Text hashing and file hashing
Text mode converts the exact JavaScript string to UTF-8 bytes before hashing. Letter case, spaces, punctuation, invisible line endings, and Unicode normalization all matter. The text Hello has a different digest from hello, and a final newline changes the bytes even if it is hard to see in an editor.
File mode reads the selected file as raw bytes. It does not interpret the filename or file type, and the filename is not included in the digest. Renaming a file without changing its contents therefore keeps the same result. Editing metadata embedded inside a document or image changes its bytes and normally changes every listed digest.
How to compare a checksum carefully
- Obtain the expected checksum through a trusted channel, preferably the publisher’s HTTPS website, signed release information, or a verified package repository.
- Select the exact algorithm named by the publisher. SHA-256 and SHA-512 values are not interchangeable.
- Choose the downloaded file and generate its digest. Compare the full result, not only its beginning or ending.
- If the values differ, do not run or distribute the file. Recheck the selected file and algorithm, then download again from the trusted source.
Methodology and privacy
SHA-1, SHA-256, and SHA-512 are calculated with the browser’s Web Cryptography SubtleCrypto.digest() interface. MD5 is implemented locally for compatibility because Web Crypto intentionally does not expose it as a standard digest algorithm. Hex output prints each digest byte as two hexadecimal characters. Base64 output represents the same digest bytes in a different text format; changing the display format does not calculate a different hash.
The page reads the entire selected file into memory before calculation, so it limits files to 250 MB to reduce the chance of freezing a browser tab on a work laptop or mobile device. Closing or refreshing the page releases the page’s references to that data. The tool does not upload the chosen file, but browser extensions or compromised device software are outside MiniUtils’ control.
Frequently asked questions
Can a hash be reversed?
A secure digest is designed to be one-way, but common or short inputs can be guessed by hashing candidate values and comparing results. That is one reason an unsalted fast hash is unsafe for passwords.
Can I use SHA-256 to store passwords?
Not by itself. Password storage should use a dedicated password-hashing construction such as Argon2, scrypt, bcrypt, or PBKDF2 with a unique salt and carefully selected work factor. Follow the current guidance for your platform.
Why does my result differ from another tool?
Check the input bytes, algorithm, file, character encoding, line endings, trailing spaces, and whether one tool hashed a displayed hexadecimal string instead of the underlying bytes. For text, this page uses UTF-8 without adding a newline.
Is a matching hash proof that a file is safe?
No. It shows that the file matches the expected digest. If both the file and expected digest came from an attacker-controlled location, they may match perfectly. Trust the source before trusting the comparison.
Does hexadecimal provide more security than Base64?
No. They are two encodings of identical digest bytes. Hex is longer and common in command-line checksum tools; Base64 is shorter and common in some APIs and metadata formats.
Why are MD5 and SHA-1 still included?
Users sometimes need to verify old published checksums. Clear legacy labels allow compatibility without implying that either algorithm is appropriate for a new security design.
Technical references
The W3C Web Cryptography specification defines the browser digest operation used for SHA algorithms. Algorithm definitions and test vectors are published in NIST FIPS 180-4. MD5’s original specification appears in RFC 1321, while later security guidance should be consulted before using any digest in an adversarial system.