Hash Generator
Paste any text and get its MD5, SHA-1, SHA-256, and SHA-512 hashes at once. Use it to verify a download checksum, prove a file has not changed, or generate a fingerprint for a string in your code. The hashes are computed on your device with your browser's built-in cryptography, so your input never leaves the page. Free, no signup, nothing stored.
One rule before you start: SHA-256 is the safe default. MD5 and SHA-1 are shown for legacy checksums only, and a plain hash is not encryption and not a password store, as explained below.
How to Use the Hash Generator
- Paste your text. Type or paste anything into the box: a password candidate, a license key, a block of code, a sentence you want to fingerprint.
- Read all four hashes at once. MD5, SHA-1, SHA-256, and SHA-512 appear instantly below the box, no button press needed.
- Copy the one you need. Hit Copy beside SHA-256 for most jobs. The others are there for legacy systems and cross-checking.
- Compare, do not trust. To verify a download, paste the checksum the publisher lists and compare it character by character with the hash you computed. One differing character means a different file.
Which Algorithm Should You Pick
- SHA-256: the default. The standard choice for checksums, signatures, and integrity checks. A 64-character hex digest, fast, and unbroken.
- SHA-512: the longer digest. Same family as SHA-256 with a 128-character output. Pick it when a system or spec asks for it; for everyday checksums it buys nothing SHA-256 lacks.
- SHA-1: legacy only. Still seen in old Git objects and older download pages, but collision attacks against it are practical. Never use it for anything an attacker could tamper with.
- MD5: legacy checksums only. Fast and everywhere in old tooling, but collisions are trivial to produce. Fine for spotting accidental corruption in a file you already trust the source of, useless as a security guarantee.
Real Uses for a Hash Generator
- Verify a download. Publishers post a SHA-256 checksum beside installers and disk images. Hash the file you downloaded (on your terminal,
sha256sum file.binon Linux orcertutil -hashfile file.bin SHA256on Windows) and confirm it matches before you run it. - Prove nothing changed. Hash a document before sending it, and hash the copy that comes back. Identical hashes mean identical content, down to the last byte.
- Fingerprint strings in code. Cache keys, deduplication IDs, and change detection all start with hashing the input string and comparing digests instead of full text.
- Check two versions of a text. Paste the old version, note the hash, paste the new one. Different hash means something changed, even if the difference is invisible whitespace.
What Hashing Is Not
Hashing is one-way, not encryption. There is no key and no decryption step: the same input always gives the same digest, and the digest cannot be turned back into the input. That is exactly why hashes work as fingerprints, and exactly why a plain SHA-256 hash is not password storage. Passwords need a slow, salted function built for the job, like bcrypt or Argon2, so that a leaked database cannot be reversed with a lookup table. If you are storing passwords, do not use this tool for that; use a password-hashing library.
Frequently Asked Questions
What is a cryptographic hash?
A cryptographic hash is a fixed-length fingerprint of some input. The same input always produces the same hash, but even a one-character change produces a completely different hash.
Which hash algorithm should I use?
Use SHA-256 or SHA-512 for anything security-related. MD5 and SHA-1 are broken and should only be used for non-adversarial checksums.
Is this hash generator private?
Yes. SHA variants use the browser's built-in Web Crypto API, and MD5 is computed in JavaScript locally. Nothing is uploaded.
Why is MD5 considered broken?
MD5 is vulnerable to practical collision attacks — two different inputs can produce the same hash. Never use it for signatures, password hashing, or integrity against an attacker.
Can I hash a file?
This tool hashes text. For files, use a dedicated tool or a command like sha256sum file.bin on your terminal.
What is the difference between SHA-256 and SHA-512?
Output length and internal block size. SHA-256 produces a 64-character hex digest, SHA-512 a 128-character one. Both are in the SHA-2 family and neither is broken. SHA-512 is sometimes faster on 64-bit hardware; for ordinary checksums the choice rarely matters, so SHA-256 is the usual default.
Can a hash be reversed to recover the original text?
No, not directly. A hash is one-way: you cannot compute the input from the digest. But short or predictable inputs can be guessed by hashing candidate values until one matches, which is why hashing a weak password with plain SHA-256 does not protect it. Long, random inputs are not practically reversible this way.
Is SHA-256 safe for storing passwords?
No. SHA-256 is fast, which is the opposite of what password storage needs. Attackers can test billions of guesses per second against a fast hash. Store passwords with a slow, salted function designed for the job, such as bcrypt or Argon2, never with a plain hash from this tool.
How do I verify a downloaded file's checksum?
Find the SHA-256 checksum the publisher lists on the download page, hash your downloaded file with sha256sum file.bin on Linux or macOS, or certutil -hashfile file.bin SHA256 on Windows, then compare the two strings character by character. An exact match means the file is intact; any difference means it is corrupted or tampered with, and you should not run it.
Why do two nearly identical inputs give totally different hashes?
That is the avalanche effect, and it is deliberate. Changing a single character scrambles roughly half the output bits, so similar inputs never produce similar digests. It is what makes a hash a reliable change detector: any edit, however small, shows up immediately.