Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files right in your browser.

Hash Generator tool

Loading...

Example

Input: hello

Result: MD5: 5d41402abc4b2a76b9719d911017c592, SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

The text is hashed as UTF-8 bytes. SHA-1 of the same input is aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d, and changing a single character changes every hash completely.

Hash Output Sizes

AlgorithmBitsHex charactersSafe for security?
MD512832No, collisions found
SHA-116040No, collisions found
SHA-25625664Yes
SHA-38438496Yes
SHA-512512128Yes

Lengths measured from each algorithm's output for the word hello.

  1. Type or paste the text you want to hash, or switch to File Input and select a file.
  2. Click "Generate Hashes" to see the output for all supported algorithms (MD5, SHA-1, SHA-256, SHA-384, SHA-512) at once.
  3. Compare hash values across algorithms to choose the one that fits your use case.
  4. Click the copy button next to any individual hash to copy it to your clipboard.
  5. Use the generated hash for checksums, data integrity verification, or password storage workflows.

MD5, SHA-1 and SHA-256 Hashes Explained

A hash function turns any input into a fixed-length fingerprint. This tool computes the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or a file in one click. The word hello, for example, always gives the SHA-256 hash that starts 2cf24dba5fb0.

Three properties make hashes useful. The same input always gives the same output. A tiny change, even one letter, gives a completely different result. And you cannot run a hash backwards to get the input. That is why hashes are used to check downloads, spot changed files, build cache keys and, with extra safeguards, store passwords.

The algorithms differ in length and strength, as the table shows. MD5 and SHA-1 are broken for security, because researchers can create two different inputs with the same hash. They are still fine for catching accidental changes. For anything security-related, use SHA-256 or longer. Passwords need a slow, salted method instead, such as the one in the Bcrypt Hash Generator.

Text is hashed as UTF-8 bytes exactly as typed, including any trailing space or line break. To check a download, switch to File Input, pick the file and compare the SHA-256 value with the one the publisher lists. Output is lowercase hex, with an Uppercase switch. The SHA hashes use the browser's Web Crypto API and MD5 uses a built-in implementation, so nothing is uploaded. For keyed signatures, see the HMAC Generator.

Sources

Frequently Asked Questions

No. A hash throws information away, so there is no way to compute the input from it. Attackers instead guess inputs and hash each guess, often with huge lists of common passwords. Short or common inputs are found quickly this way, which is why a plain fast hash is not safe for storing passwords.
Almost always the input differs by an invisible character. The shell command echo "hello" | sha256sum hashes hello plus a line break, while this tool hashes exactly what is in the box. Use echo -n to leave out the line break. Also check for trailing spaces, Windows line endings (CRLF) and a different text encoding.
Find the checksum the publisher lists, usually SHA-256. Switch this tool to File Input, select the file and click Generate Hashes. Compare the SHA-256 line with the published value; the case of the letters does not matter. If even one character differs, the file is corrupt or has been changed.
Not for security. Practical attacks can create two files with the same MD5 hash, so it cannot prove a file is authentic or protect passwords. It is still fine for non-security jobs such as cache keys, detecting duplicate files or catching transfer errors, where nobody is trying to trick you. The same advice applies to SHA-1.
No. SHA-256 is designed to be fast, so an attacker with a graphics card can try billions of guesses per second. Password storage needs a slow algorithm with a unique salt per user, such as bcrypt, scrypt or Argon2. These are built to make each guess expensive.
A plain hash depends only on the input, so anyone can compute it, and anyone who changes the data can compute a new one. An HMAC mixes in a secret key, so only someone who holds the key can produce the right value. APIs and webhooks use HMAC signatures to prove a message came from them and was not changed on the way.

Related Tools

Password Generator

Generate strong, secure passwords with customizable length, character types, and multi-word passphrases.

Security and Encryption

Text Encryption and Decryption

Encrypt and decrypt text using AES-256 encryption entirely in your browser. No data sent to servers.

Security and Encryption

Base64 Encode and Decode

Encode text to Base64 and decode Base64 strings back to readable text, with full UTF-8 support.

Developer Tools

Bcrypt Hash Generator and Verifier

Generate bcrypt hashes with configurable rounds and verify passwords against existing bcrypt hashes.

Security and Encryption

HMAC Generator

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512 with custom secret keys for message authentication.

Security and Encryption

JWT Decoder

Decode JSON Web Tokens to inspect header, payload, and signature without needing the secret key.

Developer Tools