Hash Generator

A hash function takes any input — a word, a document, a disk image — and produces a fixed-length string called a digest. The same input always produces the same digest, but even a one-character change produces a completely different result. This property makes hashes useful for verifying that a downloaded file arrived intact, confirming that two files are identical without comparing them byte by byte, and detecting whether data was modified in transit. This tool computes MD5, SHA-1, SHA-256, and SHA-512 hashes in your browser using the native Web Crypto API (SHA variants) and an inline MD5 implementation — no server upload, no third-party service.

How to use

1. Choose Text or File mode. Text mode hashes typed or pasted strings and updates automatically as you type. File mode accepts any file type via drag-and-drop or the file browser, then computes the hash when you click Generate Hash.
2. Select an algorithm. SHA-256 is the default and the right choice for most purposes. Choose MD5 or SHA-1 if you need to match a checksum published by a third party that used those algorithms.
3. Read the hash. The output is shown as a lowercase hex string with the bit length and character count displayed next to it. Click Copy hash to copy it to your clipboard.
4. Verify a match (optional). Paste an expected hash into the verify field below the output. A green check confirms the hashes are identical; a red X means they differ. This is useful for confirming a downloaded file against a published SHA-256 checksum.

Tips for best results

• Use SHA-256 as your default. Unless you specifically need to match a legacy MD5 or SHA-1 checksum, SHA-256 is the right choice. It is fast, collision-resistant, and supported natively in every modern browser, operating system, and programming language.
• Use the compare field for file verification. When a software project or download page publishes a SHA-256 checksum alongside a file, use File mode, drop the downloaded file, select SHA-256, and paste the published checksum into the verify field. A green check confirms the download is intact and unmodified.
• Hashes are case-insensitive. The verify field normalizes both values to lowercase before comparing, so a checksum published as uppercase (common on Windows) matches the lowercase output this tool produces.
• Text hashes are encoding-sensitive. The same characters can produce different hashes if the encoding differs. This tool encodes text as UTF-8 before hashing, which is the standard for web content. If you are matching a hash computed from a different encoding (UTF-16, Latin-1), the results will differ even if the visible text is identical.

Why use PixMidas

• 100% private. All hashing runs locally. Text is processed by the browser's native Web Crypto API. Files are read into memory and hashed without any upload. Neither your text nor your files leave your device.
• Four algorithms in one tool. MD5, SHA-1, SHA-256, and SHA-512 cover every common checksum format. Switch algorithms instantly without re-entering input.
• Hash verification built in. The compare field lets you check a computed hash against an expected value directly in the tool — no manual string comparison required.
• No account needed. Free, instant, no file size limits.

Frequently asked questions

What is a hash and what is it used for?

A hash (or digest) is a fixed-length fingerprint computed from arbitrary input data. The same input always produces the same output, but any change to the input — even a single bit — produces an entirely different output. Common uses: verifying downloaded files match their published checksum (integrity check), detecting whether two files are identical without reading them byte by byte (deduplication), storing passwords in a form that can be verified but not reversed (authentication), and signing documents to prove they have not been tampered with (digital signatures).

Which algorithm should I use?

Use SHA-256 for any new purpose. It is fast, widely supported, and has no known practical attacks. Use SHA-512 when you want a longer digest for extra margin or when matching a system that requires it. Only use MD5 or SHA-1 when you need to match a checksum that was published using those algorithms — both are cryptographically broken for security purposes and should not be used in new systems. For file verification, the algorithm used was set by whoever published the checksum; match their choice.

Why is MD5 considered broken?

MD5 is broken because it is feasible to generate two different inputs with the same MD5 hash — a collision attack. This means an attacker can create a malicious file that has the same MD5 hash as a legitimate one, undermining the integrity check. SHA-1 has the same problem, with demonstrated collision attacks published since 2017. Neither should be used for password storage, certificates, digital signatures, or any security-critical purpose. For file download verification they are still acceptable if the checksum was published by a trustworthy source and you just need to confirm the download is complete and uncorrupted — you trust the server, you're just checking for transmission errors.

Can a hash be reversed to recover the original input?

No. Hash functions are one-way: given only the hash output, there is no algorithm that can recover the input. You can only verify a hash by re-computing it from the original data and comparing. For short or common inputs like passwords, attackers use precomputed lookup tables (rainbow tables) of common values, but this is not reversing the hash — it is matching it against a known list. Long, random strings have no practical attack.

Are the hashes this tool produces the same as other tools?

Yes. SHA-1, SHA-256, and SHA-512 are NIST-standardized algorithms with a single specification — every correct implementation produces identical output for the same input. The SHA variants use the browser's native crypto.subtle.digest() which is required by the Web Crypto specification to follow the FIPS standard exactly. MD5 uses an inline implementation validated against RFC 1321 test vectors. You can cross-check with terminal commands: shasum -a 256 filename on macOS/Linux, or certutil -hashfile filename SHA256 on Windows.

Why does hashing a file take longer than hashing text?

Files are read from disk into memory as an ArrayBuffer before hashing begins. For large files (hundreds of megabytes), the read step itself takes a moment before the hash computation starts. The hash computation is fast — a modern CPU hashes gigabytes per second using SHA-256. The perceived delay is almost entirely the file read time, not the hash computation.