Hashery
Hash generator, MD5 and SHA
Which algorithm should you use?
For verifying a download, use whichever the publisher published — usually SHA-256. The point is comparing against their value, so the algorithm is their choice, not yours.
For anything security-relevant, use SHA-256 or better. MD5 and SHA-1 are both broken for collision resistance: an attacker can construct two different inputs with the same digest. They are included here because plenty of existing systems still emit them and you need to check against those, not because you should choose them for something new.
Hashing is not encryption, and not password storage
A hash is one-way — you cannot recover the input from the digest. But a plain hash of a password is trivially reversed by looking it up in a precomputed table, because the same password always produces the same digest.
Storing passwords requires a deliberately slow algorithm with a per-user salt — bcrypt, scrypt, or Argon2. None of the algorithms on this page are suitable, and no amount of applying them repeatedly makes them so.
Verifying a downloaded file
Choose the file above, then paste the publisher's checksum into the compare box. The comparison ignores case and surrounding whitespace, so you can paste straight from a release page without tidying it up.
A match confirms the file arrived intact. It does not prove the file is trustworthy — if an attacker controls the page publishing the checksum, they control both sides of the comparison. For that, you need a signature, not a hash.
This tool runs entirely in your browser. Nothing you type, paste or open is sent to util.quest or anywhere else — there is no upload and no request to make one. You can disconnect from the network and it will keep working.
Produce MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text or file, all at once, so you can compare against a published checksum without hunting for the right command. Includes a compare box that tells you plainly whether two hashes match.
It's one of the free tools in the util.quest collection — nothing to install, and no account needed. Found a bug or want a feature? Reach out at [email protected].
