Hash Generator
Generate MD5, SHA-1/2/3, and RIPEMD-160 hashes from text or a file, locally.
Hashing Configuration
Understanding Cryptographic Hashing Algorithms
Cryptographic hashing converts arbitrary input data into a fixed-size signature or checksum. One-way hash functions are foundational components of modern security, ensuring data integrity, passwords verification, and code sign validations.
MD5 & SHA-1
**MD5** (128-bit) and **SHA-1** (160-bit) are legacy algorithms. While extremely fast and widely used for non-cryptographic checksum verification, their structural vulnerabilities to collision attacks make them deprecated for passwords or highly secure signatures.
SHA-2, Keccak & RIPEMD
The **SHA-2** family (SHA-224/256/384/512) and **Keccak** (256/512 — the original sponge construction behind SHA-3, used by Ethereum's keccak256) are cryptographically secure, with strong collision resistance. **RIPEMD-160** remains widely used in Bitcoin address derivation.
Keys, Salts & Security
Enabling a custom **salt** appends or prepends a secret key to the input string. This simple step eliminates vulnerability to pre-computed **rainbow table** dictionary attacks, rendering unauthorized lookup attempts computationally infeasible.
100% Client-Side Web Crypto API
ZeroServer.tools relies on the browser's hardware-accelerated **SubtleCrypto API** (Web Crypto Standard) for the SHA-1/SHA-2 calculations, with Keccak, RIPEMD-160 and MD5 computed in-page. Text and dropped files alike are hashed entirely inside sandboxed browser memory — no inputs, keys, or hashes are ever transmitted across the network.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Checking a downloaded ISO or archive against the checksum the publisher printed, before you run it.
- Producing a content fingerprint to use as a cache key, where identical input must map to an identical name.
- Comparing two files that should be identical without diffing them byte by byte.
- Confirming a file survived a transfer intact when the transport gives you no integrity guarantee.
- Generating a stable identifier for a blob whose own name you do not control.
How it works in practice
A worked example
A release page prints a checksum without saying which algorithm made it, and you want to confirm the file you downloaded is the one they published.
Text: hello world Verify against: b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 release-notes.txt
MD5 5eb63bbbe01eeed093cb22bb8f5acdc3 SHA-1 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed SHA-256 b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 Match
The pasted line was never trimmed by hand. A checksum utility prints the digest, two spaces and a filename, and the verify field unwraps both that layout and the parenthesised BSD one before it compares anything, because nobody edits a checksum manually. It then compares against every algorithm on the page at once, so which one the publisher used falls out of the result instead of having to be known first. Sixty-four hex characters landed on SHA-256 here; forty would have landed on SHA-1 with nothing extra to click.
The edge case that catches people
Switch the output to Base64 and the comparison stops ignoring letter case, which catches out anyone who has only ever pasted hex. A hex digit means the same thing in either case, so folding case there is not merely safe but necessary, since your toggle and the publisher's may disagree. Base64 uses letter case to distinguish six-bit values, so a and A are different data — this field once folded case for both encodings and reported a match for a Base64 digest that differed from the real one in capitalisation alone, which is exactly the failure a verify field exists to catch.
When not to use this tool
A digest is not a signature. Webhook verification at Stripe, GitHub or Slack uses HMAC, which mixes a shared secret into the calculation, so running the request body through this page will never reproduce the header they sent whichever algorithm you try — that needs a keyed tool. The same distinction rules it out for storing credentials, where deliberate slowness is the entire requirement and speed is the defect, and for comparing two files you already have locally, which diff answers far more usefully than two long strings that look alike.
Frequently Asked Questions
- What's the difference between MD5, SHA-1, SHA-256, and SHA-512?
- They differ in output size and security: MD5 (128-bit, broken — avoid for security), SHA-1 (160-bit, deprecated), SHA-256 (256-bit, secure, widely used), SHA-512 (512-bit, highest security). Use SHA-256 or SHA-512 for modern applications.
- Can a hash be reversed to recover the original input?
- No. Hash functions are one-way by design. However, common inputs (passwords, dictionary words) can be cracked via rainbow tables or brute force. This is why passwords must be hashed with a salt using bcrypt or Argon2 — not plain SHA.
- Is this tool safe for hashing passwords?
- No — never use plain SHA hashes for passwords. They are too fast, making brute-force attacks feasible. Use bcrypt, Argon2, or PBKDF2 instead. Try the bcrypt-generator tool for password-safe hashing.
- What is a file hash used for?
- File hashing verifies integrity: hash a downloaded file and compare it with the publisher's posted hash. A mismatch means the file was corrupted in transit or tampered with. SHA-256 is the standard for software verification.
- Why do I get a different hash than another tool for the same input?
- Check for encoding differences. A UTF-8 BOM prefix, a trailing newline, or different whitespace will change the hash entirely. Ensure both tools hash the exact same bytes — 'hello' and 'hello\n' produce different results.
Common errors and gotchas
- Hashing a password with a general-purpose digest. These are built to be fast, which is exactly the wrong property for a password.
- Comparing hashes computed over different inputs — one with a trailing newline, one without — and concluding the file is corrupt.
- Trusting a checksum published on the same page as the download. If an attacker can change one, they can change the other.
- Assuming a hash is reversible. It is not, and a match against a rainbow table is a lookup rather than a reversal.
- Mixing hex and Base64 representations of the same digest and reading the difference as a mismatch.