MD5 Hash Generator: MD5 and SHA-1 for Text and Files
Get the MD5 and SHA-1 hash of any text as you type, or of files of any size, and check them against a download's published checksum. Everything is calculated in your browser.
- Nothing uploaded
- Any file type and size
- Checked against official test values
HMAC with a secret key (optional)
How to test it
- Type abc. MD5 should be
900150983cd24fb0d6963f7d28e17f72, the official test value. - Paste that value into Expected hash. The MD5 row shows Match.
- Hash a file here and with your computer (
certutil -hashfile file MD5on Windows,md5sum fileon Linux,md5 fileon Mac). They'll be identical.
Self-check: running…
How this MD5 hash generator works
Exact bytes, no changes
Text is turned into UTF-8 bytes exactly as typed, and files are read byte for byte. Nothing is trimmed or cleaned, so results match md5sum, certutil and other standard tools.
Large files in pieces
Files are read 4 MB at a time and hashed as they stream, with a progress bar. Multi-gigabyte ISO files and backups work without running out of memory.
Checked every time
When the page loads, it hashes the official RFC 1321 and FIPS 180 test inputs and compares the results, so you can see the calculator is correct before trusting it.
Check it yourself. Open your browser's developer tools (F12) and choose the Network tab, then type text or choose a file. No requests are made: the hashing code runs on your device.
What people use this MD5 generator for
Find your task. Each button sets the tool up for it.
| Your task | How | Action |
|---|---|---|
| Check a download matches the published MD5 | Choose the file under Files and paste the checksum into Expected hash. | |
| My hash doesn't match the one from md5sum | echo adds a newline. Tick Add a newline at the end, or hash the file itself. |
|
| An API or payment gateway wants an HMAC-MD5 or HMAC-SHA1 signature | Open HMAC with a secret key and enter the key your provider gave you. | |
| I need a checksum that can't be forged | MD5 and SHA-1 can be faked on purpose. Use SHA-256 for anything security-related. | SHA-256 generator |
How MD5 and SHA-1 are calculated here
MD5 (RFC 1321) turns any input into a 128-bit value, shown as 32 hex characters. SHA-1 (FIPS 180-4) produces 160 bits, or 40 hex characters. Both process the input in 64-byte blocks, which is why this page can hash a file piece by piece.
The code is written for this page and doesn't use an outside library. It was tested against Node.js's built-in hashing on random data split at random points, including HMAC with short and long keys.
Both algorithms are broken for security: researchers can deliberately create two inputs with the same hash. They still reliably detect accidental changes, which is what most checksums are for.
Sources: RFC 1321 (MD5), FIPS 180-4 (SHA-1), RFC 2104 (HMAC), RFC 6151 (MD5 security).
Official test values, checked live
Press Try it to load an input exactly, then compare the result with the table. The first row is no text at all, not the words shown.
| Input | MD5 | SHA-1 | This page |
|---|---|---|---|
| nothing (empty input) | d41d8cd98f00b204e9800998ecf8427e | da39a3ee5e6b4b0d3255bfef95601890afd80709 | … |
abc | 900150983cd24fb0d6963f7d28e17f72 | a9993e364706816aba3e25717850c26c9cd0d89d | … |
message digest | f96b697d7cb7938d525a2f31aaf161d0 | c12252ceda8be8994d5fa0290a47231c1d16aae3 | … |
abcdefghijklmnopqrstuvwxyz | c3fcd3d76192e4007dfb496cca67e13b | 32d10c7b8cf96570ca04ce37f2a19d84240d3a89 | … |
MD5 mistakes to avoid
Common ways MD5 gets misused or gives a "wrong" answer.
MD5 is far too fast for passwords. Leaked MD5 password lists are cracked in hours. Use Argon2 or bcrypt.
A matching MD5 proves the file wasn't damaged, not that nobody replaced it. Prefer SHA-256 from the official site.
echo adds a hidden newline, so the hash differs from "hello". Use echo -n.
There are only about 10 billion 10-digit numbers. Every MD5 of them can be listed in minutes.
Good habits with checksums
When downloading
- Copy the checksum from the official site, not from a mirror.
- Prefer SHA-256 when the site offers it.
- Compare the whole hash, not just the first few characters.
- If it doesn't match, delete the file and download it again.
- For software, also check the publisher's digital signature where available.
When building software
- Use MD5 only for caching keys, deduplication and corruption checks.
- Use SHA-256 or SHA-3 for integrity that matters.
- Use Argon2id, scrypt or bcrypt for passwords.
- Hash the exact bytes you store: agree on encoding and line endings.
- Keep HMAC keys secret and rotate them if exposed.
Frequently asked questions
Short answers about privacy, mismatches, security and file size.
Is my text or file uploaded?
No. MD5 and SHA-1 are calculated by code on this page, in your browser. Nothing you type or choose is sent to our server, and the page works offline once it has loaded.
Why is my hash different from md5sum or another tool?
Usually because of an invisible difference in the input: a trailing newline (echo adds one), Windows line endings (CRLF), or extra spaces. Tick "Add a newline at the end" to match echo, or use the Files tab to hash the exact bytes of a file.
Is MD5 still safe to use?
For spotting accidental corruption, yes. For security, no: researchers can create two different files with the same MD5, and SHA-1 has the same weakness. Use SHA-256 for tamper-proof checksums, and a slow password hash such as Argon2 or bcrypt for passwords.
Can an MD5 hash be reversed?
Not mathematically, but short or common inputs can be looked up in huge precomputed tables. That's why an unsalted MD5 of a password or phone number protects almost nothing.
Is there a file size limit?
No fixed limit. Files are read in 4 MB pieces, so even multi-gigabyte files work without filling memory. Speed depends on your device, typically 50 to 150 MB per second.
How do I check a download's MD5 checksum?
Open the Files tab, choose the downloaded file, and paste the checksum from the download page into Expected hash. A green Match means the file is identical to the original.
What is an HMAC and when do I need one?
An HMAC combines a secret key with the message, so only someone with the key can produce the same result. Some APIs and payment gateways sign requests with HMAC-MD5 or HMAC-SHA1. Enter the key in the HMAC field to get one.