FIRST CH TOOLS LOCAL PROCESSING — NOTHING IS UPLOADED 日本語

FIRST CH TOOLS / 23 HASH GENERATOR

MD5 / SHA-256 / SHA-512 Hash Generator

Hashes any text or file with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at the same time. Paste a published checksum and it is verified against every digest instantly, and results can be copied as hex (lower or upper case), Base64 or base64url. The SHA family is computed with the browser's built-in Web Crypto API, so neither your text nor your files ever leave this device.

Type and all five digests appear at once

Text
Digests
Value to verify (optional)

Upper or lower case, a sha256:… prefix, the <digest>␣␣<filename> form printed by sha256sum, colon-separated hex and Base64 are all accepted as they are.

0
Input bytes
0
Characters
0
Lines
—
Verification
Notes

    How to Use

    1. Enter somethingType into the text box, or drop a file onto the File tab. All five digests are recalculated as you type.
    2. Pick a formatSwitch between hex (lower or upper case), Base64 and base64url. For text, the line endings (LF / CRLF) and the BOM change the digest too, so match whatever the other side used.
    3. Copy or verifyUse the copy button on each row. Paste a published checksum into the verification box and the matching row is marked ✓, while a row of the same length that does not match is marked ✕.

    About This Tool

    A hash function turns data of any length into a fixed-length value in one direction only. The same input always produces the same digest, a single changed byte produces a completely different one, and the original data cannot be recovered from the digest. That is what makes hashes useful for confirming a download is intact, detecting that something changed, and signing API requests.

    The SHA family is computed with the browser's Web Crypto API (crypto.subtle.digest) — a native implementation, so even large files are fast. MD5 is not part of Web Crypto, so it is computed by the RFC 1321 implementation shipped with this page. Either way the data is processed on your device and never sent anywhere.

    MD5 and SHA-1 are broken. Producing two different inputs with the same digest (a collision) is practical and cheap, so neither can be trusted for signatures, certificates or tamper detection. They survive because of legacy systems and because they are still perfectly adequate as a check for accidental corruption in transit. For anything new, use SHA-256.

    Never store passwords as a plain hash. SHA-256 is fast, and that is exactly what an attacker wants: a GPU can try billions of candidates per second. Passwords need a per-user salt and a deliberately slow algorithm (bcrypt, scrypt or Argon2). Treat this tool as being for integrity checks and signature preparation.

    When the same text produces a different digest somewhere else, the cause is almost always the line endings or a BOM. Windows text files end lines with CRLF (0D 0A), macOS and Linux with LF (0A), and to a hash function those are simply different data — as is a trailing newline at the end of the file. Both are switchable here, so you can reproduce the other side's conditions exactly. The character encoding is always UTF-8 (to hash Shift_JIS bytes, convert the file with the encoding converter first and drop the result onto the File tab).

    The verification box accepts command output as-is: the <digest>␣␣file.zip form from sha256sum, the output of shasum -a 256, the SHA256 (file) = … form, a sha256:… prefix, colon-separated hex, and Base64 (such as the part after sha384- in a Subresource Integrity attribute). The algorithm is inferred from the length.

    Nothing you enter leaves the browser. Directly callable via URL parameters: /en/hash/?text=hello / /en/hash/?text=hello&fmt=base64 / /en/hash/?text=hello&expect=5d41402abc4b2a76b9719d911017c592

    From AI Agents

    The same hashing logic is available as the hash_generate tool of the MCP (Model Context Protocol) server @first-ch/tools-mcp, so an AI agent can call it directly without a browser. See Using these tools from AI agents for details.

    Install

    claude mcp add firstch-tools -- npx -y @first-ch/tools-mcp

    Examples

    # Hash a string (MD5 / SHA-1 / SHA-256 / SHA-512 by default)
hash_generate(text="hello")

# SHA-256 only, as Base64
hash_generate(text="hello", algorithms=["sha256"], format="base64")

# Verify a downloaded file against its published checksum
hash_generate(path="/tmp/app.dmg", expected="9f86d081884c7d65...")

# Reproduce a Windows text file (CRLF + BOM)
hash_generate(text="a\nb", newline="crlf", bom=true)

    Other Tools