Suishou Tools

Hash Generator

Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for any text or file in one go. Paste a published checksum to confirm that a download is intact and untampered.

How to use the Hash Generator

  1. Choose “Text” to hash typed or pasted text, or “File” to hash a file from your device.
  2. Type the text, or choose or drop a file. All five hashes appear at once.
  3. To verify a download, paste the checksum from the publisher’s site into “Compare with a checksum”. The tool tells you which algorithm matches.
  4. Click “Copy” next to any hash. Tick “Uppercase output” if you need uppercase hex, as shown by Windows tools.

What is a hash?

A cryptographic hash function turns input of any size into a fixed-length fingerprint. The same input always gives the same hash, and changing a single bit changes the result completely. MD5 produces 128 bits (32 hex characters), SHA-1 160 bits (40), SHA-256 256 bits (64) and SHA-512 512 bits (128).

Hashes are one-way: you cannot get the original data back from the hash. That makes them useful for verifying file integrity, detecting changes, deduplicating data and building digital signatures.

How to verify a download with SHA-256

Software projects such as Ubuntu, Python and VS Code publish a SHA-256 checksum next to each download. Choose “File”, select the file you downloaded, then paste the published value into the compare box. “Match” means the file is byte-for-byte identical to what the publisher released; “No match” means it is corrupted, incomplete or not the file you expected.

You can do the same on the command line: certutil -hashfile file.iso SHA256 or Get-FileHash file.iso in PowerShell on Windows, shasum -a 256 file.iso on macOS, and sha256sum file.iso on Linux. Windows prints uppercase hex; the comparison here ignores case and spaces.

MD5 and SHA-1 are broken for security

Practical collision attacks exist for both MD5 (since 2004) and SHA-1 (Google’s SHAttered, 2017), so attackers can create two different files with the same hash. Don’t use them for digital signatures, certificates or anything where someone might deliberately forge a match. They are still fine for spotting accidental corruption and as cache keys. For security, use SHA-256 or stronger, as recommended by NIST.

Don’t store passwords as plain hashes

Fast hashes like MD5 and SHA-256 are designed to be quick, which lets attackers test billions of password guesses per second on a GPU. Store passwords with a slow, salted algorithm built for that purpose, such as Argon2id, bcrypt or scrypt. OWASP’s Password Storage Cheat Sheet recommends Argon2id first.

Frequently asked questions

Can a hash be decrypted or reversed?

No. Hashing is not encryption and there is no key. “MD5 decrypt” sites only look up hashes of common words and leaked passwords in huge precomputed tables; they cannot reverse a hash of random data.

Why is my hash different from another tool’s?

Usually the input differs: a trailing newline (echo adds one unless you use -n), Windows CRLF line endings, extra spaces, or a different text encoding. This tool hashes text exactly as typed, encoded as UTF-8.

Is it safe to hash confidential files here?

Yes. Files are read and hashed locally with the browser’s Web Crypto API. Nothing is uploaded, so it works even for private documents.

Is there a file size limit?

The file is loaded into memory, so files up to a few hundred MB work well on most computers. Multi-gigabyte ISO images may fail in the browser; use the command-line tools listed above for those.

Which algorithm should I use?

SHA-256 for almost everything: it is widely supported, fast enough and secure. Use MD5 or SHA-1 only to match a checksum someone else published in that format.

Does uppercase or lowercase matter?

No. Hex is case-insensitive, so A1B2 and a1b2 are the same hash. The compare box ignores case and spaces.

Last updated: View source code

Password Generator Create a strong, random password in one click. Pick the length and character types and see how strong it is instantly. Passwords are generated on your device only. Base64 Encode and Decode Turn text into Base64 or decode a Base64 string back to readable text. Everything is handled as UTF-8, so accented letters, emoji and non-Latin scripts come back exactly as they went in. UUID Generator Generate up to 100 UUIDs at once, either random version 4 or time-ordered version 7. Paste an existing UUID below to see which version it is and, for v1, v6 and v7, when it was created. JWT Decoder Paste a JWT to see its header and payload as formatted JSON. Time claims such as exp and iat are converted to dates in your time zone, and a live countdown tells you whether the token has expired. JSON Formatter Paste JSON to validate and pretty-print it instantly, or minify it into a single line. If it is invalid, you get the exact line and column plus a plain-English explanation of what is wrong. Color Converter Convert any CSS color between HEX, RGB, HSL and OKLCH, and see right away whether white or black text on it passes WCAG contrast. Works with transparency too. Roman Numeral Converter Type a number to get its Roman numeral, or type a Roman numeral to get the number. Each result is broken into parts, so you can see how it is built. Unix Timestamp Converter Check the current Unix timestamp, or convert between epoch time and human-readable dates. Seconds and milliseconds are detected automatically, and every result is shown in your local time, UTC and ISO 8601.