Hash Generator

Generate MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 digests of any text at once. Runs entirely in your browser. Nothing is sent to any server.

Input text

Uppercase

Digests

All six digests appear here as you type

What is a hash function?

A hash function turns an input of any size into a fixed-length fingerprint. The same input always produces the same digest, a one-character change produces a completely different one, and there is no way to run the function backwards to recover the original text. This tool computes all six digests at once from the UTF-8 bytes of what you type, so you can compare formats side by side. SHA-1, SHA-256, SHA-384 and SHA-512 are computed by your browser's native crypto API; MD5 and SHA-224 are computed in JavaScript here, because the Web Crypto standard doesn't include them. Either way nothing leaves your device.

Choosing an algorithm

MD5 (128 bits)

Broken for security since 2004: collisions can be produced on a laptop in seconds. Still everywhere as a non-security checksum, an ETag, or a cache key, and still what many legacy systems and file-listing sites publish. Never use it for passwords, signatures, or to prove a file wasn't tampered with.

SHA-1 (160 bits)

Also broken: a practical collision was demonstrated in 2017 and browsers stopped trusting SHA-1 certificates. Git still uses it for object ids, and plenty of APIs still sign with it, so you'll keep meeting it. Treat it like MD5: fine as an identifier, not as a security guarantee.

SHA-224 and SHA-256

The 32-bit members of the SHA-2 family, and the sensible default today. SHA-256 is what TLS certificates, blockchain protocols, package checksums and signed tokens use. SHA-224 is SHA-256 truncated to 224 bits, useful when a protocol specifies that exact length.

SHA-384 and SHA-512

The 64-bit members of SHA-2. They are not just longer, they use a different internal word size, which makes them faster than SHA-256 on 64-bit hardware. SHA-384 is SHA-512 truncated, and is what several TLS cipher suites and JWT algorithms specify.

Examples

The same digest computed in the languages you're most likely to reach for:

JavaScript

const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(str));
const hex = [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");

Python

import hashlib

hashlib.sha256(text.encode("utf-8")).hexdigest()

Java

MessageDigest.getInstance("SHA-256")
  .digest(text.getBytes(StandardCharsets.UTF_8));

import "crypto/sha256"

fmt.Printf("%x", sha256.Sum256([]byte(text)))

PHP

hash("sha256", $text);

Shell

printf "%s" "$text" | sha256sum
printf "%s" "$text" | md5sum

Use Cases

Verifying a download

Paste the checksum published next to a file and compare it against what you compute locally. If a single character differs, the file you have is not the file that was published.

Reproducing a signature or a cache key

When an API rejects your request or a cache misses, hashing the exact string you think you sent is the fastest way to find out whether your input differs from what the other side expected.

Deduplicating records

Hashing a normalized version of a record gives you a short, fixed-length key for spotting duplicates without comparing every field.

Checking test fixtures and migrations

Many migration tools and config systems store a checksum of each file to detect edits after the fact. Computing that digest by hand tells you why a tool is reporting a file as changed.

Frequently Asked Questions

Can a hash be reversed or decrypted?

No. Hashing is one-way by design and isn't encryption: there is no key and no decrypt operation. Sites that claim to 'decrypt MD5' are looking the digest up in a table of previously hashed values, which only works for inputs someone already hashed, like common passwords or short strings.

Which algorithm should I use?

SHA-256 unless something tells you otherwise. Use SHA-384 or SHA-512 when a protocol asks for them or when you're on 64-bit hardware and want more speed per byte. Only use MD5 or SHA-1 when you must match an existing system, never for new security-relevant work.

Should I hash passwords with this?

No. Plain hash functions are built to be fast, which is exactly wrong for passwords: an attacker with a stolen database can try billions of guesses per second. Passwords need a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2. This tool is for checksums and fingerprints, not for storing credentials.

Why do I get a different digest than another tool?

Almost always because the input bytes differ, not the algorithm. The usual culprits are a trailing newline (many command-line tools add one, this page does not), different line endings (LF versus CRLF), leading or trailing whitespace, or a different text encoding. This tool hashes exactly the UTF-8 bytes of what's in the box.

What does 'not collision-resistant' mean next to MD5 and SHA-1?

It means someone can construct two different inputs that produce the same digest. That breaks any use where the hash is meant to prove which content you have, such as signatures or integrity checks. It does not mean anyone can recover your input from the digest, and it doesn't stop them from being useful as plain identifiers.

Can I hash a file here?

Not yet: this tool hashes text you type or paste. Hashing a large file synchronously would freeze the page, so file support needs chunked reading, which is planned separately. For now, use sha256sum, shasum or certutil on the command line for files.

Is my input sent anywhere?

No. Every digest is computed locally in your browser, either by its built-in crypto API or by JavaScript running on this page. Nothing you type is transmitted or stored on any server.