Guides / Dev utilities

MD5 vs SHA-256: How to Hash Text and Check a File Checksum

Last reviewed October 12, 2026

A hash turns any amount of data into a short fixed-length fingerprint. Change a single character in the input and the fingerprint changes completely. That makes hashes ideal for checking that a download is intact and for spotting whether two files are identical.

What a hash does

A hash function reads data of any size and produces a fixed-length string of letters and digits. The same input always gives the same result, a tiny change gives a completely different result, and you cannot work backwards from the hash to the original data. A hash is not encryption, because there is nothing to decrypt.

MD5, SHA-1, SHA-256 and SHA-512

  • MD5 produces a 32 character result. It is fast and still used to detect accidental corruption, but it is broken for security, since different inputs can be crafted to give the same hash.
  • SHA-1 produces a 40 character result. It is also considered weak for security and is being phased out, though you still see it in older systems.
  • SHA-256 produces a 64 character result and is the modern default for checksums, certificates and software signing.
  • SHA-512 produces a 128 character result. It is stronger on paper and is sometimes faster on 64-bit machines.

Use SHA-256 unless something specific asks for another. Never store passwords with any of these plain hashes. Passwords need a slow, salted password hashing method designed for the purpose.

Hash text with Anvil

  1. Open Dev utilities and choose the hashing tab.
  2. Choose an algorithm: MD5, SHA-1, SHA-256 or SHA-512.
  3. Type or paste your text into the box.
  4. Press Hash and copy the result.

Be careful with invisible differences. A trailing space or line break changes the hash, so two pieces of text that look identical can give different results.

Check that a downloaded file is intact

  1. Find the checksum the publisher lists next to the download. It is usually SHA-256.
  2. In the hashing tab, choose the same algorithm and select the downloaded file instead of typing text. When a file is selected, it is used and the text box is ignored.
  3. Press Hash and compare the result with the published value, character by character.

If they match exactly, the file is the one the publisher released, with no corruption in transit. If they differ even slightly, download it again from the official source. A matching hash proves integrity only when the published value itself comes from a trusted page, since an attacker who can change the file could also change a hash posted beside it.

Your file stays private

Files you hash are read in a temporary location on the server and removed as soon as the result is returned. Anvil keeps no copy. See the privacy page. For text encoding rather than fingerprinting, read Base64 encoding explained.

Try it now

Open the Dev utilities tool. It is free, needs no account, and your files are deleted right after conversion.

Related guides