Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text, in your browser.
A hash is a fixed-size fingerprint of a piece of data. Feed the same input into MD5, SHA-1, SHA-256 or SHA-512 and you get back a string of a fixed length that is unique enough to treat as an identifier, yet impossible to reverse into the original text. That one-way property is why hashes are everywhere: checksums, file deduplication, content addressing and integrity checks all rely on it.
Paste or type any text, pick an algorithm, and the digest appears immediately. The SHA family runs through the same Web Crypto engine your browser uses for HTTPS; MD5 is computed locally with a compact implementation. Toggle uppercase if your tools expect the digest in that form.
A word of caution that matters for real projects: these are plain hashes, not password hashes. Storing a password as its MD5 or SHA-256 value is not password security - the digests are fast to compute and trivially reversed against common dictionaries. If you are building password storage, reach for a slow, salted algorithm such as bcrypt, scrypt or Argon2 instead of using this tool.
Features
- Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests in one click.
- SHA family computed with Web Crypto - the same native engine behind your browser's TLS.
- UTF-8 aware: hashing "你好" produces the digest of its actual bytes, not a mangled string.
- Lowercase and uppercase output, ready to paste into tools that expect either form.
- Instant results for any input size - hashing is a single native pass.
- Everything runs locally. The text you hash never leaves your device.
How to Use
- 1
Enter the text
Type or paste the data you want to fingerprint - a password to test a checksum, a config value, or a string from a legacy system that still uses hashes.
- 2
Pick an algorithm
Choose MD5, SHA-1, SHA-256, SHA-384 or SHA-512. For new work, prefer SHA-256 or stronger; older systems may require the digest a specific tool expects.
- 3
Hash it
Press Hash (or Ctrl+Enter). The digest renders immediately as a hex string of the length your algorithm defines.
- 4
Toggle uppercase if needed
Some tools, file listings and database columns expect uppercase hex. Tick Uppercase and the output re-renders in that form.
- 5
Copy the digest
Use Copy to grab the hash for a checksum file, a uniqueness check or a legacy comparison. The result is deterministic - the same input always produces the same digest.
Example
SHA-256 of "hello"
hello↓
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824MD5 of "hello"
hello↓
5d41402abc4b2a76b9719d911017c592Common Problems
Using plain hashes to store passwords
MD5 and SHA-2 are fast, which is exactly why they are wrong for password storage. An attacker can run billions of guesses per second. Use a slow, salted password hash - bcrypt, scrypt or Argon2 - with a per-user salt.
Expecting a hash to be reversible
Hashes are one-way. You cannot recover the input from a digest. Lookup tables of common inputs exist, but for anything non-trivial the digest reveals nothing about the original text.
Two inputs with the same hash
Hash functions map an infinite space of inputs to a fixed-size output, so collisions are mathematically guaranteed to exist. MD5 and SHA-1 collisions are cheap to construct on modern hardware - never rely on them for security decisions.
Encoding confusion when hashing non-ASCII text
The digest depends on the exact bytes. Hashing "café" as UTF-8 versus Latin-1 gives different results. This tool always uses UTF-8, matching what modern systems hash.
Relying on MD5 or SHA-1 for security
Both have broken collision resistance. They remain useful for checksums, deduplication and compatibility, but any decision that rests on them - a signature, a certificate, the integrity of a critical file - should move to SHA-256 or better.
Technical Details
SHA-1, SHA-256, SHA-384 and SHA-512 are computed with crypto.subtle.digest, the native Web Crypto implementation. MD5 is computed locally with a compact pure-TypeScript implementation because the Web Crypto standard deliberately omits it.
Output is hex-encoded and lowercase by default. The digest length varies by algorithm: 32 hex chars for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512.
Input is UTF-8 encoded before hashing, so the digest matches what your backend, scripts or other tools produce for the same string.
Hashing is a single native pass with no size limit below the browser's memory ceiling. Even large pastes hash in milliseconds.
Nothing is transmitted. The digest is computed in your browser tab and discarded when you close it - the tool holds no state between visits.
Frequently Asked Questions
What is a hash used for?
As an identifier or integrity check: verifying that a downloaded file matches its published checksum, detecting accidental corruption, deduplicating content, or producing a fixed-length key from a longer value. A hash lets you compare two pieces of data without storing the data itself.
Can I use this tool to store user passwords?
No. These are fast, unsalted hashes designed for checksums and identifiers. For password storage you need a slow, salted password-hashing scheme such as bcrypt, scrypt or Argon2, usually with a unique salt per user. Using MD5 or SHA-2 for passwords is one of the most common - and most damaging - security mistakes.
Why does the same input sometimes give a different hash?
It should never. A hash is deterministic: the same bytes always produce the same digest. If you see different results, the inputs differ in some way you cannot see - a trailing space, a newline, a different encoding, or a full-width versus ASCII character. Compare the raw bytes.
Which algorithm should I choose?
For new work, SHA-256 or SHA-512. SHA-1 and MD5 are still used for compatibility with legacy systems and for non-security checksums, but their collision resistance is broken and they should not back security decisions.
Is the text I hash uploaded?
No. Hashing runs entirely in your browser. Nothing you enter is sent to a server, stored or logged.
Why does MD5 still exist if it is broken?
Because it is still deployed across legacy protocols, file formats and databases, and for non-security uses - verifying a copy, deduplicating content - its weaknesses are irrelevant. The danger is treating it as a security primitive, which it is not.
Data & Privacy
Your data stays in your browser. Nothing is uploaded.
- Processing
- Local
- Upload
- None
- Server Storage
- None
- Account
- Not required
Related Tools
JWT Decoder
Inspect the header, payload and claims of a JSON Web Token - decoded locally, never uploaded.
Security & Tokens
Random String Generator
Generate secure random strings and passwords with control over length and character set.
Security & Tokens
HMAC Generator
Sign a message with a secret key using HMAC-SHA256 or HMAC-SHA512, right in your browser.
Security & Tokens
UUID Generator
Generate random UUID v4 identifiers in bulk, with or without dashes, in your browser.
Security & Tokens
JWT Validator
Check a JWT's structure and time claims - signature is never verified, so the verdict is about usability, not authenticity.
Security & Tokens
Base64 Encode & Decode
Convert text to Base64 or decode it back, with an optional URL-safe mode - all in your browser.
Encoding & Conversion
Related Guides
Base64 Guide: What It Is and How to Encode and Decode
Base64 encodes binary data into 64 safe ASCII characters, adding about 33 percent size. Learn how padding works and why it is transport, not encryption.
Hash vs Encryption: What Is the Difference?
Hashing is one-way and deterministic; encryption is two-way with a key. Learn which protects passwords vs data in transit, and why the two differ.