OpenGPT.in

Hash Generator

SHA-256, SHA-384 and SHA-512 for text or a file.

Runs in your browser Runs entirely in your browser. Nothing you put in it ever leaves your device.

Algorithms

Broken since 2017. Fine for matching an old published checksum, not for security.

Hashed as you type, as UTF-8 bytes. An empty box still has a hash — that is the famous e3b0c442… value.

Ready. Nothing is sent anywhere.

Hashes

Choose at least one algorithm and give it something to hash.

    Paste a checksum from a download page. Spacing, capitals and a trailing filename are all fine.

    Was this useful?

    About this tool

    A hash is a short fingerprint of some data: the same input always produces the same hash, and any change produces a completely different one. That makes it the standard way to check that a download arrived intact. Hashing here is done by your browser’s own cryptography implementation, so even a 200 MB file is read straight off your disk and never uploaded.

    How to use it

    1. Choose Text or File.
    2. Tick the algorithms you need — SHA-256 is the usual answer.
    3. Type, paste, or choose a file. The hashes appear immediately.
    4. To check a download, paste the published checksum into the compare box at the bottom.

    Supported input

    • Any text, hashed as UTF-8 bytes
    • Any file up to 200 MB
    • Output as hexadecimal or Base64
    • SHA-256, SHA-384, SHA-512 and SHA-1

    Privacy

    Runs entirely in your browser. Nothing you put in it ever leaves your device. Everything happens in JavaScript on this page, so the tool keeps working even if you go offline after it has loaded — which is the simplest way to see for yourself that nothing is being sent. Read the full privacy information.

    Questions

    Is hashing the same as encryption?

    No. Encryption is reversible if you hold the key; hashing is not reversible at all. A hash proves that two things are identical without revealing what they are — it does not protect or hide anything on its own.

    Why is there no MD5?

    Because your browser’s cryptography API does not implement it — deliberately, since MD5 has been broken since the early 2000s. Offering it would mean shipping our own hand-written implementation of an algorithm nobody should be choosing today, which is a worse trade than leaving it out and saying why.

    Then why offer SHA-1 at all?

    Because checksums published years ago still use it, and Git object ids are SHA-1. It is there to let you match an existing value, and is labelled “Not secure” wherever it appears.

    My hash does not match the one on the download page.

    Nine times out of ten the published checksum is a different algorithm from the one you are computing. The compare box works out which algorithm a pasted hash is from its length and tells you, rather than just reporting a mismatch.

    Is my file uploaded to check it?

    No. The file is read from your disk by your browser and hashed in this page — which is also why it is fast: there is no upload to wait for. Disconnect from the network after the page loads and it still works.

    Can I hash a password with this?

    You can, but you should not use the result to store one. Passwords need a slow, salted algorithm such as bcrypt or Argon2 precisely because SHA-256 is fast — that speed is what lets an attacker try billions of guesses.

    Related tools