# Hash generator and checksum calculator (MD5, SHA-256)

> Generate MD5, SHA-1, SHA-256, SHA-512 and CRC-32 hashes of any text, check them against a published checksum, and see the avalanche effect.

Interactive version: https://www.calcopenly.com/programming/hash-checksum-calculator
Subject: Programming and tech calculators

A cryptographic hash turns any input into a fixed-size digest: 128 bits for MD5, 160 for SHA-1, 256 for SHA-256 and 512 for SHA-512, while CRC-32 is a 32-bit error-detecting checksum. The text is encoded as UTF-8, padded to whole 512-bit or 1024-bit blocks, and run through the algorithm's compression rounds as NIST FIPS 180-4 and RFC 1321 specify.

People use it to verify downloads against a published checksum, compare files and test their own code. The default sentence, "The quick brown fox jumps over the lazy dog", has the SHA-256 digest d7a8fbb3…37c9e592, and flipping one input bit changes 141 of its 256 bits, close to the half a good hash should change.

MD5 and SHA-1 have practical collision attacks, so use SHA-256 or SHA-512 wherever someone could tamper with the data.

## Inputs

- **Text**: Hashed as UTF-8 bytes. Line breaks count as a single line feed (\n).
- **Algorithm** (options: MD5, SHA-1, SHA-256, SHA-512, CRC-32)
- **Show digests as** (options: hex, HEX, Base64)
- **Add a line feed at the end**: Matches `echo text | sha256sum`, which hashes the text followed by a line feed.
- **Compare with checksum**

## Results

- Digest — main result
- Comparison
- MD5
- SHA-1
- SHA-256
- SHA-512
- CRC-32
- Input size (bytes)
- Digest size (bits)
- Digest bits changed by flipping one input bit (bits)

## Formula

$$
\begin{aligned} \text{blocks} &= \left\lfloor \frac{n + 8}{64} \right\rfloor + 1 && \text{MD5, SHA-1, SHA-256} \\ \text{blocks} &= \left\lfloor \frac{n + 16}{128} \right\rfloor + 1 && \text{SHA-512} \end{aligned}
$$

## Worked examples

### “abc” (FIPS 180-4 one-block example)

- Text: abc
- Algorithm: SHA-256
- Show digests as: hex
- **Digest: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad**
- **MD5: 900150983cd24fb0d6963f7d28e17f72**
- **SHA-1: a9993e364706816aba3e25717850c26c9cd0d89d**
- **SHA-512: ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f**
- **CRC-32: 352441c2**
- **Input size: 3 bytes**
- Checked against: FIPS 180-4 / NIST CSRC SHA-1, SHA-256, SHA-512 examples for “abc”; RFC 1321 §A.5 MD5 test suite; all five re-checked with Python 3.8 hashlib and binascii.crc32

### Empty string

- Algorithm: SHA-512
- Show digests as: hex
- **Digest: cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e**
- **MD5: d41d8cd98f00b204e9800998ecf8427e**
- **SHA-1: da39a3ee5e6b4b0d3255bfef95601890afd80709**
- **SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855**
- **CRC-32: 00000000**
- **Input size: 0 bytes**
- Checked against: RFC 1321 §A.5 (MD5 of ""); Python 3.8 hashlib.md5/sha1/sha256/sha512(b'').hexdigest() and binascii.crc32(b'')

### 448-bit message (two blocks for SHA-256)

- Text: abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq
- Algorithm: SHA-256
- Show digests as: hex
- **Digest: 248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1**
- **SHA-1: 84983e441c3bd26ebaae4aa1f95129e5e54670f1**
- **SHA-512: 204a8fc6dda82f0a0ced7beb8e08a41657c16ef468b228a8279be331a703c33596fd15c13b1b07f9aa1d3bea57789ca031ad85c7a71dd70354ec631238ca3445**
- **Input size: 56 bytes**
- Checked against: FIPS 180-4 / NIST CSRC two-block examples for the 448-bit message; re-checked with Python 3.8 hashlib

### 896-bit message (two blocks for SHA-512)

- Text: abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmn…
- Algorithm: SHA-512
- Show digests as: hex
- **Digest: 8e959b75dae313da8cf4f72814fc143f8f7779c6eb9f7fa17299aeadb6889018501d289e4900f7e4331b99dec4b5433ac7d329eeb6dd26545e96e55b874be909**
- Checked against: FIPS 180-4 / NIST CSRC SHA-512 two-block example; re-checked with Python 3.8 hashlib.sha512

### MD5 test suite: “message digest”

- Text: message digest
- Algorithm: MD5
- Show digests as: hex
- **Digest: f96b697d7cb7938d525a2f31aaf161d0**
- Checked against: RFC 1321 §A.5 test suite; re-checked with Python 3.8 hashlib.md5

### MD5 test suite: 80 digits (two blocks)

- Text: 12345678901234567890123456789012345678901234567890123456789012345678901234567890
- Algorithm: MD5
- Show digests as: hex
- **Digest: 57edf4a22be3c955ac49da2e2107b67a**
- **Input size: 80 bytes**
- Checked against: RFC 1321 §A.5 test suite; re-checked with Python 3.8 hashlib.md5

## Questions

### Is MD5 still safe to use?

Not for security. Practical MD5 collisions were published in 2004, and in 2008 researchers used them to forge a trusted certificate authority certificate. RFC 6151 (2011) says MD5 is no longer acceptable where collision resistance is required, such as digital signatures. It still catches accidental corruption in a download, but use SHA-256 or SHA-512 from NIST FIPS 180-4 for anything an attacker could alter.

### What is the difference between SHA-1 and SHA-256?

SHA-256 produces a 256-bit digest (64 hex digits) against SHA-1's 160 bits (40 hex digits), and unlike SHA-1 it has no known practical collision attack. Google and CWI Amsterdam published the first SHA-1 collision, SHAttered, in 2017, and NIST has announced that SHA-1 is to be phased out of all its uses by 31 December 2030. Both belong to FIPS 180-4.

### How do I verify a file's checksum?

Hash the downloaded file and compare the result with the checksum the publisher lists; any difference means the file changed. On Linux run sha256sum file, on macOS shasum -a 256 file, and on Windows certutil -hashfile file SHA256 or PowerShell's Get-FileHash, which uses SHA-256 by default. The comparison box here does the same for text and ignores case and spaces.

### Why does echo text | sha256sum give a different hash?

Because echo adds a line feed, so the command hashes abc plus a newline (4 bytes) rather than abc (3 bytes), and one extra byte changes the whole digest: SHA-256 of abc starts ba7816bf, while abc with a line feed starts edeaaff3. Use echo -n or printf '%s' to hash the text alone, or turn on the line-feed option here to match echo.

### Can two different inputs have the same hash?

Yes, because unlimited inputs map to a fixed number of digests, but for a secure hash nobody should be able to find such a pair. By the birthday bound, a brute-force search needs about 2^(n/2) tries for an n-bit digest: 2^64 for MD5 and 2^128 for SHA-256. Known attacks find MD5 and SHA-1 collisions far faster, and CRC-32 collisions can be computed directly because CRC is linear.

### How accurate is the hash generator and checksum calculator?

Accuracy depends on your inputs and the method's assumptions. Decimal arithmetic uses 50 significant digits, but estimates, numerical methods and source data can be less precise; the displayed rounding does not remove those limits. It is checked against 11 worked examples whose answers come from independent sources; for example, ““abc” (FIPS 180-4 one-block example)” is checked against FIPS 180-4 / NIST CSRC SHA-1, SHA-256, SHA-512 examples for “abc”; RFC 1321 §A.5 MD5 test suite; all five re-checked with Python 3.8 hashlib and binascii.crc32.

### Where does the method come from?

NIST FIPS 180-4, Secure Hash Standard (SHA-1, SHA-256, SHA-512); RFC 1321 — The MD5 Message-Digest Algorithm; NIST CSRC — Examples with intermediate values (SHA-1, SHA-2); Catalogue of parametrised CRC algorithms — CRC-32/ISO-HDLC.

## Sources

- [NIST FIPS 180-4, Secure Hash Standard (SHA-1, SHA-256, SHA-512)](https://csrc.nist.gov/pubs/fips/180-4/upd1/final)
- [RFC 1321 — The MD5 Message-Digest Algorithm](https://www.rfc-editor.org/rfc/rfc1321)
- [NIST CSRC — Examples with intermediate values (SHA-1, SHA-2)](https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values)
- [Catalogue of parametrised CRC algorithms — CRC-32/ISO-HDLC](https://reveng.sourceforge.io/crc-catalogue/all.htm#crc.cat.crc-32-iso-hdlc)