Hash Generator

Q: Which hash algorithm should I use?

SHA-256 unless you have a specific reason not to. It is the algorithm behind TLS certificates and most modern API signing, and no practical collision attack is known against it. Reach for SHA-512 if you are on 64-bit hardware and want the extra width, or SHA-384 if you specifically need immunity to length-extension attacks. Do not pick MD5 or SHA-1 for anything new: both are broken, meaning an attacker can construct two different inputs with the same digest on demand.

Q: Can I use this to hash a password?

No, and this is the single most common mistake with hashing tools. Every algorithm here is designed to be fast, which is exactly wrong for passwords — a consumer GPU can try billions of SHA-256 guesses per second against a stolen database. Password hashing needs an algorithm that is deliberately slow and individually salted: bcrypt, scrypt or Argon2. Those are not offered here because they cannot be computed safely in a browser tab. The tool will warn you when your input looks like a password.

Q: Why is MD5 still here if it is broken?

Because broken for security is not the same as useless. MD5 collisions can be manufactured by an attacker, so it must never back a signature, a certificate or an integrity check that someone benefits from subverting. But when nobody is trying to trick you — confirming a file copied across a network without corruption, or bucketing cache keys — MD5 is fast and perfectly adequate. Plenty of existing systems also still emit MD5 and you need to match them. The page labels it broken so the choice is informed rather than accidental.

Q: Is my input sent to a server?

No. SHA digests are computed by your browser's built-in WebCrypto implementation and MD5 is computed by JavaScript on this page. Nothing you type leaves your machine, and there is no request to any server when you hash something. You can confirm this by opening your browser's network tab while using the tool. That said, the usual advice applies to any web tool you do not control: do not paste live production secrets into one out of habit.

Q: Why do two different tools give me different hashes for the same text?

Almost always a difference in what exactly is being hashed rather than a bug in either tool. The three usual culprits: a trailing newline that your editor added but you did not, a different text encoding (this tool hashes UTF-8 bytes, which is the modern default, but some tools use UTF-16 or Latin-1), and invisible characters such as a byte-order mark or a non-breaking space pasted in from a document. Hash the exact same bytes and every correct implementation agrees.

Q: What is the difference between a hash and encryption?

A hash is one-way and fixed-length: any input, however large, produces a digest of the same size, and there is no operation that turns the digest back into the input. Encryption is two-way and key-based — it exists precisely so the original can be recovered by someone holding the key. So hashing is for verifying that data has not changed, and encryption is for keeping data secret. If you need to get the original value back later, a hash is the wrong tool entirely.

Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text at once, with a plain verdict on which of them are still safe to use.

Text to hash (0 chars)

Digests

Compare against a published checksum (optional)

Everything is computed in your browser — SHA digests through the native WebCrypto API, MD5 in JavaScript on this page. No input is ever sent to a server.

What It Does

A hash function takes any input — a word, a paragraph, an entire file — and produces a short fixed-length fingerprint of it, written as hexadecimal. The same input always produces the same fingerprint, and changing a single character anywhere produces a completely different one. That is what makes hashes useful for checking whether data arrived intact, whether two things are identical, or whether a file has been tampered with. This tool computes five of the common digests at once so you can see them side by side. It also tells you something most generators leave out: which of those algorithms are still trustworthy. MD5 and SHA-1 are both broken — an attacker can deliberately construct two different inputs that hash to the same value — and a page that hands you an MD5 without saying so is doing you a disservice.

When to Use It

A download page publishes a SHA-256 checksum and you want to confirm the file you received matches it before running the installer.
You are matching an existing system that signs its API requests with a digest, and you need to reproduce exactly the same value locally to debug why your signature is being rejected.
You inherited code that stores MD5 digests and you need to explain to your team, with the actual output in front of them, why that has to change.
You want a short deterministic key for a cache entry or a deduplication check, and any fixed-length fingerprint of the content will do.

Worked Examples

hello world

The classic starting point. Notice the digests get longer as the algorithm widens — 32 hex characters for MD5, 64 for SHA-256 — but every one of them is the same length no matter how much text you feed in.

hello world.

The same phrase with a single full stop added. Every digest changes completely, not partially. This is the avalanche property, and it is why a hash can detect a one-byte corruption in a gigabyte file.

The quick brown fox jumps over the lazy dog

The standard sentence used in hashing documentation everywhere, so the digests below can be checked against almost any reference. Useful for confirming another tool agrees with this one.

Features

MD5

SHA-1

SHA-256

SHA-384 and SHA-512 computed together

Honest security verdict shown for every algorithm

Warning when the input looks like a password

Digest comparison against a published checksum

Live recalculation as you type

Individual copy button per digest

Bit width and character length shown for each result

Native WebCrypto used for all SHA algorithms

Entirely browser-based with no uploads

Full Unicode support via UTF-8 encoding

How to Use

1. Type or paste the text you want to hash into the input box. 2. All five digests appear immediately, each labelled with its bit width and a security verdict. 3. Use the copy button beside any digest to put it on your clipboard. 4. To verify a file against a published checksum, paste that checksum into the comparison box and the tool will tell you which algorithm it matches, if any. 5. Click Clear to reset the page.

Common Mistakes

Hashing passwords with SHA-256. Speed is the enemy here — the algorithm's efficiency is precisely what lets an attacker brute-force a stolen database. Passwords need bcrypt, scrypt or Argon2, which are slow and salted by design.
Treating a hash as encryption. There is no way to reverse a digest back to its input. If you need the original value later, you needed encryption, and discovering that after you have thrown the data away is expensive.
Assuming a matching MD5 proves a file is genuine. It proves nothing against a deliberate attacker, who can build a malicious file with the same MD5 as a legitimate one. Against accidental corruption it is fine; against an adversary it is worthless.
Forgetting the trailing newline. Hashing a file and hashing the text you pasted out of that file give different answers if the file ends in a newline and your paste did not. This is the usual reason two tools seem to disagree.
Using a plain hash of a secret plus a message to authenticate an API request. That construction is vulnerable to length extension with SHA-256. HMAC exists specifically to solve this and should be used instead.

Frequently Asked Questions

Which hash algorithm should I use?

Can I use this to hash a password?

Why is MD5 still here if it is broken?

Is my input sent to a server?

Why do two different tools give me different hashes for the same text?

What is the difference between a hash and encryption?

Related Tools

Base64 Encode Online