How to generate a hash or verify a checksum
- Choose Text to hash typed input, or File to hash a file.
- Type your text, or drop a file into the box.
- Read all five hashes in the list and copy the one you need.
- To verify a download, paste the published checksum into Compare with expected hash and look for the match badge.
What you can do with Hash Generator
- Five algorithms at once
- Calculates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 together, so you don't need to know in advance which one a site used.
- Checksum verification
- Paste an expected hash and the matching algorithm is highlighted, or you're told clearly that nothing matches.
- Hash files locally
- Drop any file type, from ISO images to installers, and it's hashed on your device without being uploaded.
- Live text hashing
- Text hashes update as you type, which is handy for testing code or checking exactly how a string hashes.
- Upper or lower case
- Switch the hex output to uppercase to match the format of checksums published by some vendors.
- Web Crypto under the hood
- SHA hashes use the browser's native Web Crypto API for speed and correctness; MD5 uses a built-in JavaScript implementation.
MD5 vs SHA-256: hash algorithms and file integrity
A cryptographic hash turns any input into a fixed-length fingerprint: change one byte and the hash changes completely. That makes hashes ideal for checking file integrity. Software publishers list SHA-256 checksums next to downloads so you can confirm the file you received is identical to the one they released and wasn't corrupted or tampered with. Text is hashed as UTF-8 bytes, so a trailing space or a different line ending produces a different result, a common reason two hashes of seemingly identical text don't match.
Not all algorithms are equally strong. MD5 and SHA-1 are broken for security purposes because collisions can be manufactured, though they're still fine for spotting accidental corruption or deduplicating files. Use SHA-256 or stronger for anything security-related. Plain hashes are also the wrong tool for storing passwords; use a slow, salted algorithm such as bcrypt, scrypt or Argon2 instead. MD5 produces 32 hex characters, SHA-256 produces 64 and SHA-512 produces 128, so the length of a checksum usually tells you which algorithm it is.
Frequently asked questions
Are my files uploaded to calculate the hash?
No. Files are read and hashed inside your browser, so they never leave your computer. That's why it works for private documents and large installers alike. The only limit is your device's memory, because the whole file is read before hashing.
How do I verify a file checksum?
Open the File tab, drop the downloaded file, and paste the checksum from the publisher's site into Compare with expected hash. A green badge shows which algorithm matched. If you see No match, the file may be incomplete, corrupted or not the official version.
Why doesn't my hash match another tool's result?
Hashes work on exact bytes. Extra spaces, a trailing newline, Windows versus Unix line endings or a different text encoding all change the result. A command like echo adds a newline at the end, while text typed here doesn't include one unless you add it.
Is MD5 or SHA-1 safe to use?
Not for security. Both have known collision attacks, so they shouldn't be used for signatures, certificates or passwords. They remain acceptable for detecting accidental corruption. For integrity checks that need to resist tampering, use SHA-256 or SHA-512.
Why do only MD5 hashes appear?
SHA hashes rely on the browser's Web Crypto API, which is only available on secure HTTPS pages. PanDev is served over HTTPS, so this only happens if the page is opened from an insecure copy or in a very old browser.