Hash generator

Generate MD5, SHA-1, SHA-256 and SHA-512 in your browser.

MD5

SHA-1

SHA-256

SHA-512

Everything is computed in your browser; your input is never sent to a server.

You need a checksum to compare against one published on a download page, or a quick fingerprint to tell two versions of a string apart. Type or paste the text and all four digests appear together, so you can copy whichever the other side is expecting.

How it works

One input, four digests

Whatever you put in the text box is hashed as MD5, SHA-1, SHA-256 and SHA-512 at the same time, each with its own copy button. Text is encoded as UTF-8 before hashing, which matters for anything beyond plain ASCII: hashing the same accented word as UTF-8 and as another encoding produces completely different digests, and mismatches between two systems usually trace back to exactly that.

Hashing is one-way. A digest cannot be turned back into the original text, and every input — however long — produces a fixed-length result: 32 hex characters for MD5, 40 for SHA-1, 64 for SHA-256, 128 for SHA-512. Change a single character of the input and the whole digest changes.

Which one to use

Algorithm	Digest length	Reasonable use
MD5	128 bits	Non-security checks: cache keys, spotting accidental corruption
SHA-1	160 bits	Legacy compatibility only — Git object IDs, older systems
SHA-256	256 bits	The sensible default for integrity and signatures
SHA-512	512 bits	Same family, longer digest; fast on 64-bit hardware

Practical collisions have been demonstrated against MD5 and SHA-1, so neither should be relied on where an attacker could benefit from forging a match. For verifying a download or signing data, use SHA-256 or SHA-512.

Not for passwords

A plain hash is the wrong tool for storing passwords, because it is designed to be fast and that is precisely what makes brute-forcing cheap. Password storage needs a deliberately slow algorithm with a per-user salt — bcrypt, scrypt or Argon2. If you are handling account credentials, follow current guidance from a security source rather than hashing directly.

Terms explained

Hash (digest): A fixed-length fingerprint derived from input data. The same input always yields the same digest; the digest cannot be reversed.
Collision: Two different inputs producing the same digest. Feasible collisions are why MD5 and SHA-1 are no longer trusted for security.
Checksum: A digest published alongside a file so you can confirm the copy you downloaded is byte-for-byte identical.
Salt: Random data added to a password before hashing so identical passwords do not share a digest. Not part of plain hashing.
Hexadecimal: The base-16 notation these digests are printed in, using the characters 0-9 and a-f.
UTF-8: The byte encoding applied to your text before hashing. Different encodings of the same characters give different digests.

Frequently asked questions

Can a hash be reversed to get the original text?

No. Hashing is one-way by design. So-called reverse lookup sites work by storing digests of billions of common strings and matching yours against the list — they are not decrypting anything.

Is my input sent to a server?

No. All four digests are computed in your browser, so the text stays on your device. It is still wise not to paste live secrets into any web page.

Should I use MD5 or SHA-1 for anything?

Only where security is not the point — a cache key, a quick way to detect accidental corruption, or compatibility with an older system that requires them. Practical collision attacks exist against both, so for integrity that someone might want to subvert, choose SHA-256.

Can I hash a password with this?

You can, but you should not store the result. Password hashing needs a slow algorithm with a per-user salt such as bcrypt, scrypt or Argon2; a fast general-purpose hash makes offline guessing far too cheap.

My digest differs from the one another tool produced. Why?

Usually invisible differences in the input — a trailing newline, a space, or different text encoding. Hashing a file also differs from hashing its filename or its displayed contents. Compare inputs character by character before suspecting the algorithm.