Calculate MD5, SHA-1, SHA-256 and SHA-512

How to Calculate Hashes

1. 1

   Drop a file or paste text

   Up to fifty files at once, or a string typed straight in. Large files are read in chunks so memory stays flat.

2. 2

   Pick which algorithms to show

   All four by default. Selecting fewer creates fewer hashers, which is measurably faster on a multi-gigabyte file.

3. 3

   Compare or copy the result

   Paste the expected checksum and the matching algorithm is identified by length and checked for you.

One pass over the data, not four

The naive way to produce four checksums is to read the file four times. Here the file is read once in sixteen-megabyte chunks and each chunk is fed to every selected hasher before the next is read, so the cost of adding a second algorithm is processor time rather than another full pass over the disk. That is also why the chunked approach matters for the memory ceiling: a two-gigabyte file never exists in memory as a whole, only sixteen megabytes of it at a time, which is what makes hashing a large ISO or video in a browser tab realistic at all.

Which algorithm to use for what

For verifying that a download arrived intact, any of the four works, because accidental corruption does not construct collisions, so use whichever the publisher listed. For anything where someone might deliberately construct a matching file, MD5 and SHA-1 are both broken: practical collisions exist for MD5 and have existed for SHA-1 since 2017, so a matching MD5 no longer proves two files are the same. SHA-256 is the sensible default for integrity that must hold against an adversary, and SHA-512 is not more secure in practice but is often faster on 64-bit hardware. None of them belongs anywhere near password storage, which needs a deliberately slow function such as Argon2 or bcrypt.

Text hashing depends on the encoding

A hash is computed over bytes, and a string is not bytes until an encoding turns it into some. The word "Привет" produces one SHA-256 as UTF-8 and a completely different one as UTF-16LE, and neither is wrong; they are hashes of different byte sequences. That is why the character set is an explicit choice rather than an assumption, and why a hash you computed elsewhere may not match here until the encodings agree. UTF-8 is the default because it is what almost every modern system means by text.

Frequently asked questions