Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 cryptographic hashes from any text — instantly in your browser, nothing sent to a server.
0 characters · 0 bytes
What is a cryptographic hash?
A cryptographic hash function takes an input of any size and produces a fixed-length output called a hash or digest. The same input always produces the same hash, but even a single character change results in a completely different output. This property — called the avalanche effect — makes hashes ideal for verifying data integrity.
Hashes are one-way functions: you can generate a hash from any text, but you cannot reverse a hash back to the original input (at least not without brute force). This makes them essential for password storage, file integrity verification, digital signatures, and content addressing.
Common algorithms differ in output length and security: MD5 produces 128-bit (32 hex char) digests and is still used for checksums despite being cryptographically broken. SHA-1 produces 160-bit digests — deprecated for security use. SHA-256 and SHA-512 (part of the SHA-2 family) are the modern standards used in TLS, JWT signatures, and Git commits.
How to generate a hash
- 1
Type or paste your text
Enter any text into the input field. All hashes update instantly as you type.
- 2
Choose your algorithm
Pick from MD5, SHA-1, SHA-256, SHA-384, or SHA-512 — or view all at once for comparison.
- 3
Copy the hash
Click the Copy button next to any algorithm to copy that specific hash to your clipboard.
When developers need a hash generator
Verify file integrity
Confirm a downloaded file hasn't been tampered with by comparing its SHA-256 hash against the publisher's expected hash.
Password hashing reference
Understand how password hashing works or generate test vectors for unit tests. Never store plain passwords — always use bcrypt or Argon2 in production.
Build Content Security Policy hashes
CSP requires SHA-256 hashes for inline <script> and <style> tags. Generate the hash here and paste it into your Content-Security-Policy header.
Generate ETags and cache keys
Hash the content of a response to produce a deterministic ETag or cache key for HTTP caching.
Example hashes
"" (empty)e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855The SHA-256 hash of an empty input is always this value — a useful sanity-check when testing your implementation.
hello5d41402abc4b2a76b9719d911017c592MD5 is deterministic — the same input always produces the same 32-character hex digest.
Algorithm comparison — which should you use?
- MD5 (128-bit): Fast, widely supported, but cryptographically broken — collisions can be generated in seconds. Use only for non-security checksums (e.g. detecting accidental file corruption). Never for passwords or signatures.
- SHA-1 (160-bit): Deprecated by NIST and all major browsers since 2017. Avoid for any new work. Still appears in older Git objects and some legacy systems.
- SHA-256 (256-bit): The current standard for most security applications — TLS certificates, JWT HMAC signatures, Bitcoin, Git's new SHA-256 object format. Use this unless you have a specific reason for a different algorithm.
- SHA-384 / SHA-512 (384/512-bit): Higher security margin, useful when extra collision resistance is required. SHA-512 can actually be faster than SHA-256 on 64-bit processors. Used in TLS 1.3 and high-security systems.
Frequently asked questions
No — hash functions are one-way by design. There is no mathematical inverse. The only way to 'crack' a hash is by guessing inputs and comparing outputs (brute force or rainbow tables), which is why salting is critical for password hashes.
Absolutely not. MD5 is fast, which makes it easy to brute-force. For passwords, always use a purpose-built slow hashing algorithm: bcrypt, scrypt, or Argon2. These are intentionally slow and include salting by design.
Hashing is one-way: you cannot recover the original input from a hash. Encryption is two-way: with the right key, the original data can be recovered. Passwords should be hashed, not encrypted — if your database of 'encrypted' passwords is stolen, the attacker can decrypt them with the key.
They use completely different mathematical operations and produce different output lengths. There is no relationship between the MD5 and SHA-256 of the same input.
Node.js: crypto.createHash('sha256').update(text).digest('hex'). Browser: const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)); then convert the ArrayBuffer to hex. Python: import hashlib; hashlib.sha256(text.encode()).hexdigest().
Need another tool?
Browse the full toolbox or dig into the blog for the engineering behind it.