Hash Generator

One input per line. Output is numbered to match the input order.
Pinned tools are listed in your favourites on the home page.Copies a link to this tool that carries your current input, so it opens ready to run.Gives you an iframe snippet for putting this tool on your own site.
Ctrl+Enter Run  · Ctrl+Shift+C Copy  · Esc Clear

Understand Hash Generator

Computes the MD5, SHA-1, SHA-256, SHA-384, or SHA-512 digest of text you paste or a file you choose, entirely in your browser.

How it works

A cryptographic hash maps input of any length onto a fixed-length digest — 128 bits for MD5, 256 for SHA-256 — and flipping a single input bit changes about half the output bits. The function is one-way: there is no operation that runs it backwards, so the only way to find an input matching a digest is to hash candidates until one matches. The SHA digests come from the browser WebCrypto API via crypto.subtle.digest; MD5 is not offered by WebCrypto, so it runs from a local RFC 1321 implementation in the page. A chosen file is read straight into an ArrayBuffer and hashed as bytes, so no text decoding can alter it.

When to use it

  • Verifying that a downloaded file matches the SHA-256 checksum published beside it.
  • Producing a stable content fingerprint for a cache key, an ETag, or deduplication.
  • Reproducing a digest a server logged, to confirm both sides hashed identical bytes.
  • Checking whether two config blobs or payloads differ without diffing them line by line.
  • Comparing MD5 and SHA-256 output while learning what digest length actually means.

Watch out for

  • MD5 and SHA-1 are broken for security use. Practical collision attacks exist for both — two different inputs can be constructed with the same digest — so they must not back signatures, certificates, or any check where an attacker picks the input. They remain fine as checksums against accidental corruption.
  • A fast hash is the wrong tool for passwords. SHA-256 is designed to be quick, and commodity GPUs compute billions of them per second. Password storage needs a deliberately slow function: bcrypt, scrypt, or Argon2id.
  • Hashing is not encryption and a digest is not always secret. The digest cannot be reversed, but a low-entropy input — a phone number, a postal code, an email address — is found in seconds by hashing every candidate and comparing.
  • The same visible text can produce different digests. A trailing newline, CRLF instead of LF, or a UTF-8 byte order mark changes the bytes and therefore the hash. Compare what was actually encoded, not what looks the same on screen.

Not the right tool for: Very large files. A chosen file is read into memory in one piece, so a multi-gigabyte image will exhaust the tab long before it finishes. Verify those locally with sha256sum, shasum -a 256, or Get-FileHash, which stream from disk.

Frequently Asked Questions

Is MD5 still secure?

No. MD5 is cryptographically broken and should not be used for security-sensitive operations like password hashing or digital signatures. It remains useful for checksums and non-security fingerprinting.

Which hash should I use?

For security: SHA-256 or SHA-512. For general checksums: any of them. Avoid MD5 and SHA-1 for security purposes as they have known collision vulnerabilities.

Is this computed in my browser?

Yes, all hashing is done entirely in your browser using the WebCrypto API (for SHA) and a local MD5 implementation. Your data never leaves your device.

How to Use Hash Generator

  1. Paste or type your input in the input area above.
  2. The tool processes your input automatically or click Run.
  3. Copy or download the result using the action buttons.
  4. Use Ctrl+Enter to run quickly from the keyboard.