Hash Generator Guide: MD5, SHA-1, SHA-256 and SHA-512 Explained

A hash is a short fingerprint of data. Feed the same input to a hash function and you always get the same output; change a single character and the output changes completely. That makes hashes ideal for checking that a file was not corrupted or tampered with. They are also widely misused, especially for passwords. This guide explains what MD5, SHA-1, SHA-256 and SHA-512 are, when to use each, how to generate and verify hashes with our Hash Generator, and the mistakes that produce "the hash does not match" confusion.

What a hash function does

A cryptographic hash function turns any input, from one word to a multi-gigabyte file, into a fixed-length string of hexadecimal characters. Three properties matter:

• Deterministic: the same input always gives the same hash.
• One-way: you cannot turn the hash back into the input. (That is not the same as being impossible to guess: short or common inputs can be found by trying candidates.)
• Sensitive: a tiny change gives a completely different result.

The sensitivity is easy to see. These are SHA-256 hashes of nearly identical text:

"Hello World"    a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
"hello world"    b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
"Hello World\n"  d2a84f4b8b650937ec8f73cd8be2c74add5a911ba64df27458ed8229da804a26

Changing one capital letter, or adding an invisible newline at the end, gives an unrelated hash. Hashing is also not encryption: there is no key and nothing to decrypt.

How to generate a hash

1. Open the tool and choose Text or File.
2. Tick the algorithms you want: MD5, SHA-1, SHA-256, SHA-512.
3. Type text, or select or drag in a file.
4. Read each hash in the results and copy the one you need.

For reference, the full set for the text Hello World (no trailing newline):

MD5      b10a8db164e0754105b7a99be72e3fe5
SHA-1    0a4d55a8d778e5022fab701977c5d840bbc486d0
SHA-256  a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
SHA-512  2c74fd17edafd80e8447b0d46741ee243b7eb74dd2149a0ab1b9246fb30382f2
         7e853d8585719e0e67cbda0daa8f51671064615d645ae27acb15bfb1447f459b

Text is converted to UTF-8 bytes exactly as typed, including spaces and line breaks, before hashing. Files are hashed by their raw bytes, so the result matches what a command-line tool reports for the same file.

Which algorithm should you use?

• SHA-256 is the sensible default for checksums and integrity checks. It is the algorithm most download pages publish.
• SHA-512 produces a longer hash (128 hex characters) and is also considered strong. Use it when a project publishes it.
• SHA-1 is broken for security: practical collision attacks exist. It is still used for non-security purposes and by some older systems, but do not choose it for anything new.
• MD5 is also broken against deliberate tampering. It remains acceptable for catching accidental corruption and for matching an existing MD5 checksum, and for quick de-duplication, but never for security.

The length tells you the algorithm: MD5 is 32 hex characters, SHA-1 is 40, SHA-256 is 64 and SHA-512 is 128.

How to verify a downloaded file

Publishers often list a checksum next to a download. Checking it confirms the file arrived intact, and, if the checksum comes from a trusted source, that it was not swapped for another.

1. Switch to File mode and select the downloaded file (or drag it in).
2. Make sure the algorithm the publisher used is ticked.
3. Paste the published checksum into the verify box. The tool ignores letter case and surrounding spaces, then compares it against every hash it generated.
4. A match tells you which algorithm matched. No match means the file is different from the one the checksum describes.

A checksum is only as trustworthy as where you got it. If an attacker can change the download, they may be able to change a checksum on the same page, so prefer checksums from a separate, trusted source (or a signed one).

The same results are available offline in a terminal, which is a useful cross-check:

sha256sum file.zip          # Linux
shasum -a 256 file.zip      # macOS
Get-FileHash file.zip       # Windows PowerShell (SHA-256 by default)

In the tool, files are read into memory whole, so very large files (many gigabytes) are better handled with the command line.

Why your hash does not match

• A trailing newline. On the command line, echo "Hello World" adds a newline, so its hash is the Hello World\n one above, not the plain one. Use printf 'Hello World' (or echo -n) to hash exactly what you typed.
• Different capitalisation or spacing. Hello World and hello world hash differently.
• Different encoding or line endings. Text saved with Windows line endings (CRLF) hashes differently from the same text with Unix line endings (LF).
• Hashing text versus hashing a file. If the file contains a newline at the end, hashing the same words typed into the text box will not match.
• A different algorithm. Compare like with like: a 64-character value is SHA-256, never MD5.
• An incomplete or modified download. The most important cause of all: re-download the file.

To see where two texts differ, use Text Compare.

Hashes are not how you store passwords

This is the most common misuse. Fast hashes such as MD5, SHA-1, SHA-256 and SHA-512 are designed to be quick, which helps attackers: a single graphics card can test billions of guesses per second against a leaked list of fast hashes. A short or common password does not survive this. For example, the MD5 of password is 5f4dcc3b5aa765d61d8327deb882cf99, and it is found in any lookup table.

For storing passwords, use a deliberately slow algorithm with a unique salt: bcrypt, scrypt or Argon2. You can try the first in our Bcrypt Generator. A plain SHA-256, even a salted one, is not the right tool for this job.

What hashes are good for

• File integrity: confirming a download or backup is unchanged.
• Change detection: knowing whether a file or record was modified.
• Deduplication: identifying identical files without comparing them byte by byte.
• Cache keys and identifiers: for example, naming a file by its content hash. (If you only need a random unique ID, a UUID is simpler.)
• Building blocks: digital signatures, HMAC and many protocols are built from hash functions.

Is it safe to hash text online?

Hashing in this tool happens in your browser: SHA hashes use the browser's built-in Web Crypto interface and MD5 is computed by a script loaded with the page. What you type or select is not uploaded for hashing. As always, avoid pasting live secrets into any website; for sensitive material use the command-line tools above.

Quick answers

Can a hash be reversed? Not mathematically, but weak inputs (short or common strings) can be matched against precomputed tables or guessed, which is why hashes alone are not enough for passwords.

Is MD5 still safe? For catching accidental corruption, yes. Against someone deliberately trying to forge a file, no.

Will two different files ever have the same SHA-256? Not in practice. No collision has ever been found, and finding one is far beyond current computing power.

What is the difference between a hash and a checksum? A checksum is any value used to detect errors; a cryptographic hash is a stronger kind that also resists deliberate forgery.