Hash Generator

Create MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, right in your browser.

Hash Generator tool

Loading...

Example

Input: abc

Result: MD5 900150983cd24fb0d6963f7d28e17f72, SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

These are the standard published test values for the 3-byte message "abc". SHA-1, SHA-384 and SHA-512 are computed at the same time.

Hash Algorithms Compared

AlgorithmOutput bitsHex charactersCollision resistance
MD512832Broken
SHA-116040Broken
SHA-25625664No practical attack known
SHA-38438496No practical attack known
SHA-512512128No practical attack known

Lengths measured by hashing the text abc. MD5 and SHA-1 collisions have been demonstrated publicly.

  1. Choose Text Input and enter or paste your text, or choose File Input and select a file.
  2. Click "Generate Hashes" to compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at the same time.
  3. Review the results below, all computed in your browser.
  4. Turn on Uppercase if you need capital hex letters.
  5. Copy any hash with its copy button.

Hashing for Integrity: MD5, SHA-1 and SHA-2

This hash generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text or file at once, right in your browser. Use SHA-256 to check that a download or file has not changed. Do not use any of these hashes on their own to store passwords.

A hash is a fixed-length fingerprint of data. Change one byte of the input and the digest changes completely. You also cannot run a hash backwards to get the input. That makes hashes ideal for integrity checks. A software site publishes the SHA-256 of an installer, you hash the file you downloaded, and you compare the two strings. If they match, you have the same file the publisher hashed.

MD5 and SHA-1 are broken for security. Researchers can create two different inputs with the same digest, which is called a collision. So neither should be used for signatures or certificates. They still work as quick checksums that catch accidental damage. SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family and have no known practical collisions.

Fast hashes are the wrong tool for passwords, because an attacker can test billions of guesses per second. Password storage needs a slow, salted method such as bcrypt, which you can try in the Bcrypt Hash Generator. If you need to prove who sent a message, not just that it is intact, use a keyed hash from the HMAC Generator.

The SHA hashes use the Web Crypto API, and MD5 uses a JavaScript version because browsers do not include it. Files are read on your device and never uploaded. An Uppercase switch changes the hex letters to capitals to match tools that print them that way.

Sources

Frequently Asked Questions

Find the SHA-256 value on the official download page. Choose File Input here, select the file you downloaded and click Generate Hashes. Compare the SHA-256 result with the published value; case does not matter. If even one character differs, the file is damaged or not the one the publisher released, so do not run it.
No. A hash is not encryption, so there is no key and no way to run it backwards. But short or common inputs can still be found by guessing: attackers hash millions of likely words and look for a match. The MD5 of a common password is easy to look up online. That is why password storage adds a random salt and a slow algorithm.
Not for anything security-related. Collisions for MD5 can be made on an ordinary computer, so an attacker can craft two files with the same MD5. It is still fine as a quick checksum to spot accidental corruption, such as a broken copy or download. For anything that must resist tampering, use SHA-256 or stronger.
SHA-256 is designed to be fast, and fast is bad for passwords. A single graphics card can compute billions of SHA-256 hashes per second, so a leaked table of unsalted SHA-256 passwords falls quickly. Password hashing algorithms such as bcrypt and Argon2 are slow on purpose and add a salt, which makes each guess far more expensive.
Yes. A hex digest is a number written in base 16, and the letters a to f mean the same value in either case. So 9F86D081 and 9f86d081 are identical. Use the Uppercase switch if another tool prints capitals, or compare the strings case-insensitively.

Related Tools

Bcrypt Hash Generator and Verifier

Generate bcrypt hashes with configurable rounds and verify passwords against existing bcrypt hashes.

Security and Encryption

HMAC Generator

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512 with custom secret keys for message authentication.

Security and Encryption

Text Encryption and Decryption

Encrypt and decrypt text using AES-256 encryption entirely in your browser. No data sent to servers.

Security and Encryption

Base64 Encode and Decode

Encode text to Base64 and decode Base64 strings back to readable text, with full UTF-8 support.

Developer Tools

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files right in your browser.

Developer Tools

BIP39 Mnemonic Generator

Generate BIP39 mnemonic seed phrases for cryptocurrency wallets in 12, 15, 18, 21, or 24 words.

Security and Encryption