Hash Generator

How it works

SHA-1, SHA-256, SHA-384, and SHA-512 are computed using your browser's built-in Web Crypto API. MD5 isn't part of that API (it's considered cryptographically broken for security purposes), so it's computed with a small standalone implementation instead — still entirely in your browser, still never uploaded anywhere.

Which hash should I use?

• MD5 and SHA-1 are fast but no longer considered secure — fine for checksums, not for security
• SHA-256 is the modern standard for most use cases (file integrity, checksums, signatures)
• SHA-384 and SHA-512 offer a larger output size for applications that call for it

Why a tiny change matters

The text hello gives an MD5 of 5d41402abc4b2a76b9719d911017c592 and a SHA-256 of 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Changing only the capital letter, Hello, gives an MD5 of 8b1a9953c4611296a827abf8c47804d7 and a completely different SHA-256 that shares nothing recognizable with the first. Adding a newline after hello gives yet another MD5, b1946ac92492d2347c6235b4d2611184.

Reading the results

• All five hashes are shown together as lowercase hexadecimal: 32 characters for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512.
• Typed text is hashed as UTF-8 exactly as it appears, updating on every keystroke. A trailing newline counts only if you type one, and clearing the box clears the results.
• File mode hashes the raw bytes of the file, up to 100 MB, and the whole file is held in memory while it is read.

Checking a download

Publishers list a checksum next to a download. Choose the file, copy the matching algorithm's value, and compare it to the published one; case does not matter, but every character must match. A mismatch means the file is damaged or is not the file the publisher released. If a command-line result differs from the text mode here, the usual cause is a newline: echoing hello into a hashing command also hashes the line ending, which gives the SHA-256 5891b5b5…6be03 instead of the value above.

What a hash cannot do

• A hash is not encryption and cannot be turned back into the original, but short or common inputs can be guessed and looked up, so an unsalted MD5 or SHA of a password offers little protection.
• Passwords should be stored with a purpose-built algorithm such as bcrypt, scrypt or Argon2, which this tool does not provide.
• There is no keyed hash (HMAC) and no salt option here.
• Collisions have been demonstrated for MD5 and SHA-1, so do not rely on them to prove a file comes from a trusted source.