Security

Hash Generator — MD5, SHA-1, SHA-256, SHA-512

Produces an MD5, SHA-1, SHA-256, SHA-384 or SHA-512 digest of your text, computed on this page.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the text you want hashed, or load a file.
  2. Choose the algorithm. SHA-256 unless something else specifically requires otherwise.
  3. Choose hex or Base64 output — the checksum you are matching against will be in one of those.
  4. Select Hash, then compare the digest character by character, or paste it into a text comparison rather than trusting your eye.

What hash generator does

A hash turns any amount of input into a fixed-length fingerprint. The same input always gives the same digest, a single changed byte gives a completely different one, and there is no way back to the input. That last property is what makes a hash useful for checking that a file arrived intact, and what makes it useless as a way of hiding something you will need to read again.

The SHA-2 family here is computed by Web Crypto, the browser’s own implementation. MD5 is not part of Web Crypto, deliberately, because it is broken — two different inputs can be constructed to produce the same digest cheaply. It is implemented here anyway for the one honest remaining use: checking a download against a checksum somebody published years ago. SHA-1 is in the same position. Use SHA-256 for anything new.

Frequently asked questions

No. The SHA algorithms run through Web Crypto, your browser’s own implementation, and MD5 runs as JavaScript on the page. Nothing is transmitted, which is the point — the values people want hashed are frequently the values they can least afford to send anywhere.

No. Hashing is one-way by design. Sites that claim to "decrypt" MD5 are looking your hash up in a table of pre-computed digests of common inputs — which works for "password123" and not for anything else. There is no reversal, only a lookup of something already hashed before.

Because it is still widely published as a download checksum, and checking a file against one is a legitimate use — it detects corruption, which is what a checksum is for. It does not detect deliberate tampering, because collisions can be constructed cheaply. Never use it for signatures, passwords or anything where an attacker chooses the input.

No. Passwords need a slow, salted algorithm designed for the job — bcrypt, scrypt or Argon2 — precisely because SHA-256 is fast, and fast is exactly wrong when someone is guessing billions of candidates. A plain SHA-256 of a password is barely better than storing it.