Extract Hashes
Pull every MD5, SHA-1, SHA-256 and SHA-512 hash out of a text, grouped by type with duplicates removed.
- Runs in your browser
- Free to use
About this tool
Threat reports and sandbox exports list file hashes in prose, tables and footnotes. The Hash Extractor finds every MD5, SHA-1, SHA-256 and SHA-512 value by its length, normalises the case, removes duplicates and returns one block per type plus a combined list, ready for blocklists and lookups, without sending the report anywhere.
Need hashes of your own text? Use the SHA Hash Generator.
How to use it — quick steps
- 01
Enter the text to scan
Type or paste the text to scan in the field above. Nothing is uploaded. Use Ctrl + V to paste.
- 02
Adjust the options
Pick the settings that fit your case; the defaults work for most people. Changes apply instantly.
- 03
Press "Extract hashes"
Press "Extract hashes" or Ctrl + Enter. The result appears below in an instant. Results can be copied.
Key features of this tool
Precise patterns
Battle-tested regular expressions match real-world formats while avoiding common false positives.
Deduplicated
Every matched entry is returned once (without duplicates), with counts of total and unique matches.
Private
The text is processed in your browser; text and documents never leave your device, ensuring data privacy.
Frequently asked questions
How are hash types told apart?
By length: 32 hexadecimal characters for MD5, 40 for SHA-1, 64 for SHA-256 and 128 for SHA-512. Other 32-hex values (GUIDs without hyphens, random tokens) will match as MD5, so review the list.
Are uppercase hashes found?
Yes, upper and lower case hex are both matched; tick Lowercase to normalise the output for deduplication and lookups.
What can I do with the list?
Paste it into a threat-intel platform, a SIEM or a sandbox search; the "All hashes" block gives you every type in one list.
Are my files or data uploaded?
No. The tool is plain JavaScript that runs in your browser; the files or data you provide here are never uploaded to our servers.