Hash Generator

How to use the hash generator

1. Type or paste the text you want to hash.
2. The MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests are calculated as you type, shown in hexadecimal.
3. To check a value, paste the expected hash into the compare field; the tool tells you whether it matches.

Hashes are computed in your browser with the Web Crypto API and JavaScript; your input is never uploaded or stored.

What is a cryptographic hash?

A hash function turns input of any length into a fixed-length fingerprint, called a digest. A good cryptographic hash is:

• Deterministic: the same input always produces the same digest.
• One-way: you cannot feasibly recover the input from the digest.
• Collision-resistant: it is infeasible to find two different inputs with the same digest.
• Sensitive: changing a single bit of input changes roughly half of the output bits.

SHA-256("hello")  = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("hello\n")= 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03

Choosing an algorithm

For anything security-related (signatures, certificates, integrity of downloads from untrusted mirrors) use SHA-256 or stronger. MD5 and SHA-1 remain acceptable only to detect accidental corruption where nobody is trying to forge a match.

Common pitfalls

Hashing is not encryption

Encryption is reversible with a key; hashing is not reversible at all. You cannot "decrypt" a hash. Short or common inputs can still be found by guessing: an attacker simply hashes candidate values until one matches, which is why lookup tables for MD5 of common words exist.

Never store passwords with a plain fast hash

MD5, SHA-1 and even SHA-256 are designed to be fast, which lets attackers test enormous numbers of password guesses per second on GPUs. Store passwords with a dedicated, deliberately slow, salted password hashing function: Argon2id, scrypt or bcrypt. These add a unique salt per password and a tunable work factor.

# Don't
stored = sha256(password)

# Do (Python, argon2-cffi)
from argon2 import PasswordHasher
stored = PasswordHasher().hash(password)

Invisible differences in input

A trailing newline, a Windows line ending (\r\n) or a different Unicode normalisation produces a completely different hash. echo hello | sha256sum hashes hello\n; use printf 'hello' or echo -n to match the result above. This tool hashes the UTF-8 bytes of exactly what you typed.

Verifying file checksums

Software downloads often publish a SHA-256 checksum. Compute the hash of the file you downloaded and compare it with the published value:

On Linux, sha256sum -c SHA256SUMS checks every file listed in a checksum file. A checksum proves the file matches what the publisher hashed; it only proves authenticity if the checksum itself comes from a trusted source, such as a signed file or an HTTPS page. You can confirm a site's certificate with the SSL checker.

Frequently asked questions

Can a hash be reversed or decrypted?

No. Hash functions discard information by design. Short or common inputs can be recovered by guessing and comparing, but not by reversing the function.

Is MD5 still safe to use?

Not for security. Collisions are trivial to produce, so MD5 must not be used for signatures, certificates or passwords. It is still fine for spotting accidental file corruption or as a cache key.

Which hash should I use for passwords?

None of the ones on this page. Use Argon2id, scrypt or bcrypt through a maintained library, which handles salting and work factors for you.

Why does my hash differ from another tool's?

Usually because the input differs: an extra newline or space, a different character encoding, or hashing a file versus its text content. Compare the exact bytes being hashed.