Skip to content

Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser

0 characters

Compute Cryptographic Hashes from Any Text

A cryptographic hash function takes an input of any length and produces a fixed-size fingerprint that is practically impossible to reverse or forge. Hashes are fundamental to software integrity checks, password storage, digital signatures, version control, and data deduplication. This tool computes hashes using five widely supported algorithms — MD5, SHA-1, SHA-256, SHA-384, and SHA-512 — directly in your browser through the Web Crypto API and a client-side MD5 implementation.

Understanding the Algorithms

MD5 produces a 128-bit (32-hex-character) hash and is fast but cryptographically broken — practical collision attacks exist, so it should not be used where an adversary could craft inputs. SHA-1 outputs 160 bits (40 hex characters) and is similarly deprecated for security but still appears in legacy systems. SHA-256 and SHA-512 belong to the SHA-2 family: 256-bit and 512-bit outputs respectively, no known practical attacks, and the standard choice for modern security applications. SHA-384 is a truncated variant of SHA-512 used in specific protocols like TLS cipher suites.

Verifying File and Data Integrity

When you download software, the publisher often provides a SHA-256 hash of the file. Hashing the downloaded file and comparing the result confirms that nothing was corrupted or tampered with during transfer. The same principle applies to database exports, configuration snapshots, and API payloads — hash the content before and after transit, and a match proves integrity. Even MD5 is adequate here because the threat is accidental corruption, not a deliberate collision attack.

Hashing in Development Workflows

Developers hash strings routinely: generating cache keys, creating deterministic identifiers from compound fields, computing content-addressable storage paths, and building ETags for HTTP responses. Git itself identifies every commit, tree, and blob by its SHA-1 hash. When debugging these systems, a quick hash of a known input against an expected output confirms that your implementation matches the reference.

Output Formats: Hex and Base64

The raw hash is a sequence of bytes. Hex encoding represents each byte as two hexadecimal characters, producing the familiar long string of letters and digits — lowercase is the convention in most tools and protocols. Base64 encodes the same bytes in a shorter string using a 64-character alphabet, which is useful in JSON payloads, HTTP headers, and compact storage. The underlying hash is identical; only the representation differs.

The Avalanche Effect

A defining property of a good hash function is that a tiny change in the input — even a single character or a case change — produces a drastically different output. This avalanche effect means you cannot infer what changed in the input by comparing two hashes, which is essential for security. Try hashing the same text with and without a trailing space to see it in action.

Privacy and Browser-Side Computation

SHA-family hashes are computed using the Web Crypto API built into every modern browser, and MD5 uses a pure JavaScript implementation. No text or hash values are transmitted to any server. This makes the tool safe for hashing sensitive content like passwords (for comparison, not storage), API tokens, and private data where uploading to a third-party service would be a risk.

$ faq

What is a hash? ▸
A hash is a fixed-length string produced by a one-way function from an input of any length. The same input always produces the same hash, but you cannot reverse the hash back to the original text. Hashes are used for integrity checks, password storage, digital signatures, and deduplication.
Which algorithm should I choose? ▸
SHA-256 is the most widely used general-purpose hash today — it is the default in TLS certificates, Git commits, and most integrity checks. Use SHA-512 when you want a longer hash or need extra collision resistance. MD5 and SHA-1 are cryptographically broken and should only be used for non-security purposes like checksums and cache keys.
Is MD5 still safe to use? ▸
Not for security. Known collision attacks let an attacker craft two different inputs with the same MD5 hash. MD5 is still useful for quick checksums (file integrity after transfer), cache keys, and non-adversarial deduplication, where collision resistance does not matter.
Can I reverse a hash back to the original text? ▸
No. Hash functions are one-way by design. Lookup tables (rainbow tables) exist for common short strings and passwords, but for arbitrary or long inputs there is no practical reversal method.
Why does changing one character produce a completely different hash? ▸
This property is called the avalanche effect. A good hash function ensures that any change in the input — even a single bit — flips roughly half the bits in the output, making the new hash appear unrelated to the old one. It prevents attackers from deducing input changes from hash differences.
Is my text sent to a server? ▸
No. SHA hashes are computed using the browser's built-in Web Crypto API, and MD5 uses a client-side JavaScript implementation. Your text never leaves the page.
What is the"All algorithms" option? ▸
It hashes your text with every supported algorithm at once and displays all results side by side. This is useful when you need to compare algorithms or provide multiple hash formats to a system that accepts more than one.