SHA-512 Hash Generator
Generate a SHA-512 hash from text or files in your browser. Get the 128-character hex digest or Base64, verify a published checksum, and hash up to 10 files in one batch. Nothing is uploaded.
SHA-512 hashing tool
https:// or in a current version of Chrome, Firefox, Edge or Safari.
Up to 1,000,000 characters, encoded as UTF-8 before hashing. Line endings and trailing spaces change the hash, exactly as they would on the command line.
No text yet.
Text result
File results
Hexadecimal only. The algorithm is detected from the checksum length: 128 characters for SHA-512, 96 for SHA-384, 64 for SHA-256 and 40 for SHA-1.
Ready. Enter text or choose files to begin.
How to use the SHA-512 hash generator
- Choose Text or Files. Text hashes update as you type. Files are queued and hashed when you click Hash files.
- Enter your input. Paste text into the textarea, or drop files onto the drop area (up to 10 files, 512 MB each).
- Pick an output format. Hexadecimal is the usual checksum format. Base64 is shorter and common in JSON APIs.
- Copy the digest. Each algorithm has its own copy button. Copy all results copies the whole report.
- Verify a checksum. Paste the published checksum into the verify field. The tool detects the algorithm from its length and tells you whether it matches the text or any hashed file.
- Download the report if you need a record outside the page.
All hashing uses the browser's native Web Crypto API. No text or file content is sent to a server.
What is SHA-512?
SHA-512 is a member of the SHA-2 family, published by NIST in FIPS 180-4. It takes an input of any length and produces a fixed 512-bit digest, which is 64 bytes or 128 hexadecimal characters. The output is deterministic: the same bytes always produce the same digest, and a single changed bit produces a completely different one. That property is called the avalanche effect.
SHA-512 is one-way. You can compute a digest from data, but you cannot recover the data from the digest. It is used for file integrity checks, digital signatures, content addressing, and anywhere a longer digest is preferred over SHA-256. It is not a password hash: it is deliberately fast, which makes brute-force attacks against stolen password databases cheaper.
SHA-512 compared with SHA-256, SHA-384 and SHA-1
| Algorithm | Digest size | Hex length | Status | Typical use |
|---|---|---|---|---|
| SHA-512 | 512-bit | 128 | Secure | File integrity, signatures, long digests |
| SHA-384 | 384-bit | 96 | Secure | Truncated SHA-512 variant |
| SHA-256 | 256-bit | 64 | Secure | Default web and TLS integrity checks |
| SHA-1 | 160-bit | 40 | Broken for collision resistance | Legacy checksum comparison only |
| MD5 | 128-bit | 32 | Broken | Not offered by this tool |
SHA-512 and SHA-256 are both considered secure. SHA-512 produces a longer digest and often runs faster on 64-bit CPUs because it uses 64-bit words internally. For most web integrity checks SHA-256 is sufficient; choose SHA-512 when a system specifies it or when a longer digest is required. SHA-1 and MD5 should not be used for new security work.
How to verify a downloaded file's checksum
Vendors often publish a SHA-512 checksum next to a download. Verifying it confirms that the file you received matches the file they published.
- Download the file and copy the published SHA-512 checksum.
- Switch this tool to Files, add the downloaded file, and click Hash files.
- Paste the published checksum into the verify field.
- If the result says Match, the file is intact. If it says No match, re-download the file before using it.
The command-line equivalents are sha512sum file on Linux, shasum -a 512 file on macOS, and Get-FileHash -Algorithm SHA512 file in PowerShell. All three should produce the same 128-character digest as this tool.
Why a checksum might not match
- The download is incomplete or corrupted. This is the most common cause. Re-download and compare again.
- The checksum belongs to a different file. Release pages often publish checksums for several builds in one list.
- The text was hashed with a different encoding. This tool uses UTF-8. A tool that uses UTF-16 or Latin-1 will produce a different digest for the same visible text.
- Line endings differ.
\nand\r\nare different bytes and produce different hashes. - A trailing newline was included. A file saved with a final line break hashes differently from the same content without it.
- The text is visually identical but uses different Unicode code points. This tool does not normalise Unicode, because normalising would change the digest from what standard tools produce for the same bytes.
Hexadecimal and Base64 output
A SHA-512 digest is 64 bytes. In hexadecimal each byte becomes two characters, giving 128 characters. In Base64 the same 64 bytes become 88 characters, including padding. Hexadecimal is case-insensitive and is the usual format in checksum files and documentation. Base64 is more compact and appears in JSON APIs and some signature headers. The uppercase option applies to hexadecimal only; Base64 is case-sensitive and is never altered.
SHA-512 is not a password hash
Because SHA-512 is fast, an attacker with a stolen database can test billions of candidate passwords per second on commodity hardware. Password storage needs a deliberately slow, memory-hard function with a tunable cost, such as Argon2id, scrypt, bcrypt or PBKDF2. SHA-512 is also vulnerable to length-extension attacks when used naively as SHA-512(secret + message); when a keyed integrity check is needed, use HMAC-SHA-512 rather than a plain hash.
A checksum also proves integrity, not authenticity. If the checksum and the file come from the same untrusted source, a match only shows that the two agree. Confirm checksums through a trusted channel when authenticity matters.
Limitations to know
- Requires HTTPS. The Web Crypto API is only exposed in a secure context. On plain HTTP the tool shows a banner instead of failing silently.
- Files are read fully into memory. Web Crypto's
digest()needs the complete buffer, so this tool caps each file at 512 MB. Larger files may exceed browser memory; use the command line for those. - No incremental hashing. A streaming implementation could hash multi-gigabyte files, but it would need a JavaScript SHA-512 implementation rather than Web Crypto. This tool prioritises native speed and correctness.
- No MD5. MD5 is cryptographically broken and is omitted deliberately, matching the approach of tools that refuse to present broken algorithms as safe options.
- Verification is hex-only. Base64 checksums are not accepted in the verify field because their length does not reliably identify the algorithm.
- No HMAC mode. HMAC-SHA-512 is a keyed construction for authentication; it is a different operation from a plain digest.
- Nothing is saved. Reloading or closing the tab clears the text, files and results.
Frequently asked questions
Is this SHA-512 generator free and private?
Yes. It is free, needs no account, and hashes text and files inside your browser using the Web Crypto API. No content is uploaded to a server, and nothing is stored after you close the tab.
What is a SHA-512 hash?
A 512-bit fingerprint of the input, shown as 128 hexadecimal characters or 88 Base64 characters. The same input always produces the same hash, and a one-bit change produces a completely different one.
Can I hash a file instead of text?
Yes. Switch to Files, add up to 10 files of up to 512 MB each, and click Hash files. Each file gets its own SHA-512, SHA-384 and SHA-256 digest, plus SHA-1 if you enable it.
How do I verify a downloaded file?
Hash the file here, then paste the vendor's published checksum into the verify field. The tool detects the algorithm from the checksum length and tells you whether it matches. A match means the file is byte-for-byte identical to the published version.
Why does my hash not match the vendor's checksum?
The download may be incomplete, the checksum may belong to a different build, or the text may have been hashed with a different encoding or line endings. Re-download first; then confirm you are comparing the right file and the right checksum.
SHA-512 vs SHA-256 — which should I use?
Both are secure. SHA-512 produces a longer digest and can be faster on 64-bit hardware; SHA-256 is the default for most web integrity checks. Use whichever the system you are integrating with specifies.
Can a SHA-512 hash be reversed?
No. Hash functions are one-way. You can test candidate inputs to see whether they produce a known hash, but you cannot recover the original input from the digest alone.
Is SHA-512 suitable for storing passwords?
No. It is deliberately fast, which makes offline brute-force attacks cheap. Use Argon2id, scrypt, bcrypt or PBKDF2 with a high cost factor for password storage.
Why is there no MD5 option?
MD5 is cryptographically broken and collisions can be manufactured. The Web Crypto API does not expose it. Offering it beside secure algorithms would imply it is a safe choice, so this tool omits it.
Does it work offline?
Yes, after the page has loaded. All hashing happens locally, so text and files can be hashed without a network connection. The initial page load still needs a connection.
Why is there a 512 MB file limit?
Web Crypto needs the entire file in memory before it can compute a digest. The limit keeps the tab stable on typical devices. For larger files, use sha512sum or shasum -a 512 on the command line.
Can I verify a Base64 checksum?
Not in the verify field. Base64 output is supported for copying and downloading, but verification accepts hexadecimal checksums only, because their length reliably identifies the algorithm.