Hash Generator
Hash text or a local file with MD5, SHA-1, SHA-256, SHA-384, or SHA-512. Data stays in this browser.
0 characters · 0 bytes (UTF-8)
Local files up to 25 MiB are read into browser memory. Choosing a file hashes its raw bytes instead of the text box.
0 hex characters · 0 bits
Text and file hashing use the same byte-oriented boundary
Text is converted to UTF-8 bytes; local files are read as raw bytes in browser memory. SHA-1/SHA-2 use crypto.subtle.digest(), while MD5 uses the vendored SparkMD5 implementation. The tool supports local files up to 25 MiB and does not upload those bytes to a hashing API.
Recorded 1 MiB SHA-2 reference timings
| Algorithm | Iterations | Average | Range |
|---|---|---|---|
| SHA-256 | 3 | 2.6693 ms | 2.0531–3.7226 ms |
| SHA-384 | 3 | 2.8131 ms | 2.5594–3.3160 ms |
| SHA-512 | 3 | 2.5974 ms | 2.3187–3.0251 ms |
These are bounded Node.js 24.14.1 / V8 Web Crypto reference measurements from the committed result file, not browser or device rankings. See every input size and timing in Z Tools Lab.
Algorithm boundaries
- MD5 and SHA-1: kept for legacy checksum/protocol compatibility; do not use them where collision resistance is a security requirement.
- SHA-256/384/512: modern SHA-2 digests for integrity and protocol workflows. The protocol you are implementing should determine the exact algorithm.
- Password storage: a fast hash is not a password KDF. Password databases should use an application-appropriate salted password-hashing scheme such as Argon2id, scrypt, or bcrypt.
- Authenticity: a plain digest does not authenticate the source. If an attacker can replace both content and checksum, use a trusted signature or keyed construction instead.
Read the hash decision guide for the compatibility/security distinction and the exact benchmark limitations.