🔧 TL3 Tools

A Hash Is a Fixed-Size Fingerprint

A hash squeezes text of any length down to a fixed-size string of hex characters. Feed this page the single word "cat" or a 10,000-word document and MD5 still returns exactly 32 characters, SHA-1 exactly 40, SHA-256 exactly 64, and SHA-512 exactly 128. The length of the input never shows up in the output.

Two properties make a hash useful. First, the same input always produces the same digest, so a hash behaves like a fingerprint you can compare side by side. Second, changing a single character scrambles the entire output, so a corrupted or tampered file becomes obvious at a glance. The process is one-way: given only a digest, you cannot reconstruct the text that produced it.

How This Page Runs Each Algorithm

SHA-256 and SHA-512 come from the browser's built-in SubtleCrypto API, the same cryptography underneath HTTPS connections and digital signatures. MD5 and SHA-1 run through a compact pure-JavaScript implementation so they work in every browser with no extra libraries. Input is encoded as UTF-8 before hashing, so accented letters, emoji, and other non-English text produce correct digests rather than mojibake.

Every calculation happens in this tab. Nothing is uploaded, logged, or kept on a server, and the page keeps working offline once it has loaded. An empty input keeps the output blank; the digest appears the moment you type.

Hash "hello" and Watch It Change

Type the word hello and compare the four digests:

• MD5 — 5d41402abc4b2a76b9719d911017c592
• SHA-1 — aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
• SHA-256 — 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
• SHA-512 — 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043

Now retype the same word with a capital H and watch every digest change completely, even though the input differs by a single letter. The compare field accepts a hash pasted from anywhere else and tells you instantly whether it matches your current output — handy when a release note or a colleague hands you a checksum to check.

Where Each Algorithm Falls Short

• MD5 — collision research from 2004 onward broke it, and a 2012 malware campaign abused a forged MD5 certificate to impersonate legitimate software. Fine for casual checksums over data you trust, wrong for anything a stranger could influence.
• SHA-1 — researchers published a real collision in 2017, and browsers stopped trusting SHA-1 certificates the same year. Keep it only for verifying files from older systems that never moved on.
• SHA-256 and SHA-512 — still sound for integrity checks, but both run far too fast for password storage. A GPU can attempt billions of digests per second, so credentials belong with a deliberately slow, salted function like bcrypt or Argon2 instead.

Browser support draws another boundary: SubtleCrypto only exists in secure contexts, so the page needs HTTPS or localhost rather than a plain http:// address.

When to Reach for a Hash

• Checking a download — compare the checksum a publisher lists against the file you actually received, catching interrupted transfers and swapped files.
• Comparing without storing — hash two values to test whether they match without keeping the originals around.
• Spotting drift — a daily hash of a configuration file or database dump reveals changes you did not intend.
• Content addressing — systems that key data by its digest, like Git objects, use the hash as the identifier itself.

Do not reach for a hash for encryption — it has no key and cannot be reversed — and do not protect passwords with a plain digest. A slow, salted key-derivation function such as bcrypt or Argon2 is the right layer for credentials, and most frameworks already handle that for you.

Questions About Hashing, Answered

What can a hash actually prove?

It proves integrity, not authorship. If you trust the channel that published a checksum, a matching digest confirms the bytes you hold are exactly the bytes that were published. Anyone can compute the digest of any text, so a hash never proves who created a file.

Why does the same text give different results on other machines?

Hashing operates on bytes, and different editors can store the same-looking text with different byte sequences. A trailing space, a Windows line ending, or an accented letter kept as two code points instead of one all change the input, and a changed input always changes the digest. Given the same bytes, the algorithm always returns the same result; the variance comes from the input, not the math.

Is MD5 ever the right choice?

Occasionally. Some legacy systems only publish MD5 sums, and for a quick sanity check over data you control, the risk of a crafted collision is usually negligible. The moment the data could be influenced by someone else — downloads, uploads, anything crossing a trust boundary — switch to SHA-256.

How do I verify a downloaded file's checksum?

This page hashes text, not files, so for a downloaded archive use your operating system. On macOS or Linux, sha256sum filename.zip prints the digest; on Windows, Get-FileHash filename.zip -Algorithm SHA256 does the same. Compare that output against the checksum on the publisher's page, character for character.

Does hashing hide my text?

No. A digest is a one-way summary, but short, common inputs are trivially reversible through lookup tables of precomputed hashes. That is why passwords need random salt plus a slow key-derivation function: without both, a hash gives an attacker almost no protection.