Hash Generator & Base64 Encoder

Which algorithm should you use?

MD5 and SHA-1 are listed because the everyday job is checking files other people produced — plenty of mirrors and vendors still publish MD5 sums. Both are cryptographically broken: collisions can be manufactured, so neither should be chosen for anything new. For new work use SHA-256.

Verifying a download

Paste the checksum published alongside a file and the algorithm is identified from its length — 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256, 128 is SHA-512. Published checksums arrive in every shape: upper case, split across lines, or with the filename appended by sha256sum. All of that is normalised before comparing, so a hash that is actually correct is not reported as a mismatch.

Text is always UTF-8

Hashing "café" here gives the same digest as sha256sum on Linux. That only holds because the text is encoded as UTF-8 before hashing — with any other encoding the digests would differ and the tool would be worse than useless for verification.

Base64 quirks that break other tools

• Whole data: URIs are accepted — the prefix is stripped, since that is what you copy out of browser dev tools.
• Whitespace and newlines are removed — that is how Base64 arrives from email headers and PEM files.
• URL-safe input works — JWT segments use - and _, which are translated back, and their stripped = padding is restored.
• Overhead is shown — Base64 is 4 characters per 3 bytes, so output is always about a third larger than the input.

Nothing is uploaded

Text and files are hashed in your browser. A file never leaves your device, which is the point — you are usually verifying it precisely because you do not fully trust where it came from.