Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any text. All computation happens in your browser.

0 characters · 0 bytes (UTF-8)

0 hex characters · 0 bits

About Hash Generator

A cryptographic hash function turns an input of any theoretical length into a fixed-size string of bits called a hash or digest. This browser tool accepts text up to five million characters; use an operating-system checksum command for files. The same input always produces the same hash, while a one-character change produces a very different result.

This tool computes hashes in your browser using the crypto.subtle.digest() API for the SHA family (backed by your operating system's native cryptography) and the SparkMD5 library for MD5 (the Web Crypto API does not expose MD5 because it is no longer considered secure). The input is never transmitted to our servers; it is hashed locally and discarded when you leave the page.

Choosing the Right Algorithm

  • MD5 — 128-bit, fast. Broken since 2004. Use only for non-security checksums (file deduplication, cache keys) where collision resistance is not required.
  • SHA-1 — 160-bit. Deprecated by NIST in 2011 after practical collisions were demonstrated. Still appears in legacy systems and Git's object format.
  • SHA-256 — 256-bit. The current default for TLS, Bitcoin, code signing, and most modern applications. No known practical attacks.
  • SHA-384 — 384-bit. A truncated form of SHA-512 used where the 256-bit output of SHA-256 is considered insufficient.
  • SHA-512 — 512-bit. The strongest standard option. Faster than SHA-256 on 64-bit hardware because it uses 64-bit operations internally.
  • SHA-3 / BLAKE3 — Not exposed by this tool. SHA-3 is the NIST-standardized alternative; BLAKE3 is faster and increasingly popular in software supply chains.

Common Use Cases

  • Text integrity checks: Compare a copied message or serialized payload with an expected digest. For downloaded files, use the operating-system commands listed in the FAQ below.
  • Cache keys: Memcached, Redis, and CDN edge servers use content hashes to deduplicate identical payloads.
  • Git commit identifiers: Git uses SHA-1 to name every object (commit, tree, blob) and detect tampering.
  • Digital signatures: Signatures are computed over the hash of a message, not the message itself, because asymmetric operations on huge inputs are slow.
  • Password storage (with care): Never store passwords in plain hashes — use a memory-hard KDF like Argon2id, bcrypt, or scrypt. Plain SHA-256 of "password123" is in every rainbow table.

Properties of a Good Hash Function

  • Deterministic: the same input always produces the same hash.
  • Fast to compute: useful for legitimate workloads (signing, indexing).
  • One-way: given a hash, infeasible to recover the input.
  • Collision-resistant: infeasible to find two inputs with the same hash.
  • Avalanche effect: a one-bit change in the input flips roughly half the bits of the output.

Hashing vs. Encoding vs. Encryption

A common mistake is treating these three as interchangeable. Hashing (this tool) is one-way: the input cannot be recovered from the output. Encoding (Base64, URL encoding) is a reversible representation of the same data, used to fit data into a transport that cannot carry raw bytes. Encryption is reversible but requires a key; without the key, the ciphertext cannot be decoded. If you need to recover the original data, hashing is the wrong tool — reach for a reversible encoding or, if the data is sensitive, a real cipher.

Frequently Asked Questions

Is the same input hash always the same?

Yes. Hashing is deterministic by design. The string "hello" will always produce the same SHA-256 hash (2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824) no matter who runs it, when, or where. This is what makes hashes useful for verifying integrity: if the hash matches, the input is unchanged.

Can I hash a file?

This tool accepts text. To hash a file, run sha256sum filename on Linux/macOS, Get-FileHash -Algorithm SHA256 filename on Windows PowerShell, or use the built-in checksum tools in 7-Zip. The browser's File API can read a file as an ArrayBuffer, which this tool could hash, but in practice the command-line tools are faster and avoid uploading the file anywhere.

Is MD5 ever still safe to use?

For accidental corruption detection (catching a corrupted download), MD5 is still fine — its collision resistance is broken, but its sensitivity to single-bit changes is not. For anything where an attacker might craft a colliding input (digital signatures, certificate fingerprints, software updates), MD5 is unsafe and you must use SHA-256 or stronger.

Why are the hex output lengths different?

The number of hex characters is twice the bit length: MD5 (×128) produces 32 hex chars, SHA-1 (×160) produces 40, SHA-256 (×256) produces 64, SHA-384 (×384) produces 96, and SHA-512 (×512) produces 128. A missing character means the hash is corrupted.

Does the hash include the algorithm name?

No. The hash is just the bits. The output 2cf24dba… is the SHA-256 of "hello", but the bits alone do not tell you which algorithm produced them. If you store hashes for later verification, always record the algorithm alongside them. A common practice is to prefix with the algorithm name (sha256=2cf24dba…) as used in the Subresource Integrity standard.