What's the difference between MD5 and SHA-256?+−
Both turn data into a fixed-length hash, but they differ in output length and collision resistance. MD5 produces a 128-bit hash and is fast, but it's been broken cryptographically - two different files can be made to produce the same MD5 hash. SHA-256 produces a 256-bit hash and is currently considered secure, which is why it's the standard choice for checksums and digital signatures today.
Is MD5 still safe to use?+−
For verifying accidental corruption (like a partially downloaded file), MD5 is still fine - it's fast and collisions don't happen by accident. For anything security-sensitive, like verifying a file came from a trusted source or wasn't deliberately tampered with, use SHA-256 or a stronger algorithm instead.
What is CRC32 used for?+−
CRC32 isn't a cryptographic hash - it's designed to catch accidental errors, like data corruption during a file transfer or in a ZIP archive, not to resist deliberate tampering. It's fast and widely used in networking and file formats for exactly that reason.
What is HMAC and when should I use it?+−
HMAC (Hash-based Message Authentication Code) mixes a secret key with your data before hashing. Anyone who only has the message cannot forge a matching HMAC without the key, so it is used to authenticate APIs, webhooks, and signed cookies. This page computes HMAC-SHA-1/256/384/512 locally — the secret never leaves your browser. Plain digests (MD5, SHA-*, CRC32) do not use a key.
Can I hash a file without uploading it anywhere?+−
Yes. Switch to File mode, choose or drop a file, and the hash is computed locally using your browser's Web Crypto API and JavaScript - the file itself never leaves your device or gets sent to a server.
Why does this tool offer both SHA-256 and SHA3-256?+−
SHA-256 (part of the SHA-2 family) and SHA3-256 are built on completely different internal designs - SHA-2 uses a Merkle-Damgård construction, while SHA-3 uses a newer sponge construction called Keccak, which makes it immune to certain theoretical attacks (like length-extension attacks) that affect SHA-2. Both are currently considered secure; SHA-3 exists mainly as a backup standard in case a weakness is ever found in SHA-2.
Why does the hash comparison ignore capital letters?+−
Hash output is often written in either uppercase or lowercase hex, so a76c... and A76C... represent the exact same hash value. This tool's compare box trims whitespace and lowercases both sides before checking for a match, so pasting a hash from a source that formats it differently still works.