About the Hash Generator
This free hash generator computes the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text, all at once and live as you type.
Hashes are computed in your browser using the Web Crypto API — your text is never uploaded.
What a hash is
A hash function takes input of any length and produces a fixed-length fingerprint. Feed it one character or an entire book; SHA-256 returns 64 hexadecimal characters either way.
Three properties make it useful:
Deterministic. The same input always gives the same hash. Always, on any machine, forever.
Avalanche effect. Change one bit of the input and roughly half the output bits flip. hello and hellp produce hashes with no visible relationship at all. There is no "close" — a hash either matches exactly or tells you nothing.
One-way. You cannot work backwards from a hash to the input. The function discards information deliberately, and there is no inverse.
That last property is the point, and it is why a hash is not encryption.
Hashing is not encryption
Encryption is two-way: with the key you get the original back. That is the entire purpose.
Hashing is one-way by design. There is no key and no way back. A 500-page document and a single letter both become 64 characters — most of the information is simply gone.
So the question a hash answers is never "what was this?" but "is this the same as that?". Compare two hashes: identical means the inputs were identical; different means they were not.
A common misunderstanding follows from this. "Decrypting" an MD5 hash is not a thing. What lookup sites actually do is hash billions of common inputs in advance and check whether yours is in the table. They are not reversing the function; they are recognising a value they have seen before. Anything unusual is not in the table.
MD5 and SHA-1 are broken — here is what that means
Both still appear everywhere, and both are unsafe for security. It is worth knowing precisely how.
A collision is two different inputs producing the same hash. That should be infeasible. For MD5 it is now trivial — collisions can be produced in seconds on an ordinary computer. SHA-1 fell in 2017, when Google demonstrated two different PDFs with the same SHA-1 hash, and the attack has only become cheaper since.
Why this matters: if someone can build two files with matching hashes, a hash no longer proves a file is the one you expected. A signed document could be swapped for a different document with the same fingerprint.
Where MD5 is still fine: detecting accidental corruption. If you want to know whether a download arrived intact, or whether two files on your disk are duplicates, MD5 works and is fast. Random corruption will not produce a collision.
Where it is not fine: anything where someone might be trying to deceive you — verifying a download's authenticity, signing, or storing passwords.
Use SHA-256 for anything that matters. It has no known practical collision attack, it is fast, and it is the default in modern systems. SHA-512 is not meaningfully more secure for most purposes, though it can be faster on 64-bit hardware.
Never store passwords with a plain hash
This is the most consequential misuse of hash functions, and it causes real breaches.
Hashing a password with SHA-256 and storing the result is not enough. Fast hashes are the problem: SHA-256 is designed to be quick, and modern hardware computes billions per second. An attacker who steals your database simply tries every likely password until the hashes match.
Two additional problems make it worse. Identical passwords produce identical hashes, so an attacker instantly sees which accounts share a password. And precomputed tables mean common passwords are recognised without any work at all.
The correct approach uses a password hashing function built to be slow and memory-hungry: bcrypt, scrypt or Argon2. They add a unique random salt per password, so identical passwords hash differently, and they are deliberately expensive — tuned so a single check takes a noticeable fraction of a second, making billions of guesses impractical.
Use a proper library. Password storage is not something to build from hash primitives.
What hashes are actually good for
- Verifying downloads — compare the published checksum against the file you received
- Detecting duplicate files — identical hashes mean identical contents
- Change detection — has this file, record or configuration been modified?
- Content addressing — Git names every commit and object by its hash
- Data integrity — confirming a transfer or a backup arrived uncorrupted
- Cache keys — a short stable identifier derived from longer content
- Digital signatures — the document is hashed, then the hash is signed
How to use it
- Type or paste your text
- The hashes update live for each algorithm
- Copy any hash with its copy button
Good to know
- Output length is fixed. MD5 gives 32 hex characters, SHA-1 gives 40, SHA-256 gives 64, SHA-512 gives 128 — regardless of input size.
- Everything counts. A trailing space, a newline at the end of a file, or a different line ending changes the hash completely. This is the usual reason a checksum "should" match and does not.
- Encoding matters. This tool hashes your text as UTF-8. Hashing the same characters in a different encoding gives a different result.
- Case is convention, not meaning. Hashes are often shown uppercase or lowercase; the value is the same. Compare case-insensitively.
- An empty input still has a hash — a well-known constant for each algorithm.
- Hashing large files is better done with your operating system's own tools: certutil -hashfile on Windows, shasum -a 256 on macOS and Linux.
Common questions
What is the difference between hashing and encryption?
Encryption is reversible — with the correct key you recover the original data, which is the whole point. Hashing is one-way by design: it produces a fixed-length fingerprint and there is no way back, because most of the information is deliberately discarded. Hashing answers "are these two things identical?", never "what was this?".
Can a hash be decrypted or reversed?
No. What lookup sites offer is not reversal but recognition: they have pre-hashed billions of common strings and check whether yours appears in the table. Common passwords and dictionary words are found instantly; anything unusual is not in the table and never will be. The function itself cannot be inverted.
Is MD5 still safe to use?
Only for detecting accidental corruption, such as checking a download arrived intact or finding duplicate files. It is completely broken against deliberate attack — two different files with the same MD5 can be created in seconds. SHA-1 is broken too, demonstrated with colliding PDFs in 2017. Use SHA-256 for anything involving trust.
Which hash algorithm should I use?
SHA-256 for almost everything. It is fast, widely supported and has no known practical collision attack. SHA-512 is a reasonable alternative and can be quicker on 64-bit systems, though not meaningfully more secure in practice. Reserve MD5 and SHA-1 for compatibility with existing systems and for non-security checks.
Can I use this to hash passwords for my website?
Please do not. Fast hashes like SHA-256 are the wrong tool: hardware can compute billions per second, so a stolen database is brute-forced quickly. Use bcrypt, scrypt or Argon2, which add a unique salt per password and are deliberately slow. Always use an established library rather than assembling password storage yourself.
Why doesn't my hash match the one published on the website?
Almost always an invisible difference in the input. A trailing space, a missing or extra newline at the end, or Windows line endings instead of Unix ones will change the hash completely — that is the avalanche effect working correctly. Also check you are comparing the same algorithm, since a page may list several.
Is my text sent to a server?
No. The SHA hashes are computed by your browser's built-in Web Crypto implementation and MD5 is computed in JavaScript, both entirely on your device. Nothing is transmitted or stored, and the tool works with your connection switched off.
Related tools
- File Checksum — hash an actual file rather than pasted text
- Password Generator — create strong passwords worth storing properly
- Base64 Encode / Decode — encoding, which unlike hashing is reversible
- JWT Decoder — tokens whose signatures are built on these hash functions
