Hash Generator — MD5, SHA-1, SHA-256, SHA-512

Type or paste text to get its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes side by side.

Input
Hashes
Ready

What is a hash?

A cryptographic hash function turns any input — a word, a document, a whole file — into a short, fixed-length fingerprint. The same input always gives the same hash, and changing even one character gives a completely different one. You cannot reverse a hash to get the input back; you can only hash a candidate input and compare.

For example, the SHA-256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, while Hello gives 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969.

Which algorithm should I use?

AlgorithmOutputStatusUse it for
MD5128 bits (32 hex)Broken for securityLegacy checksums, cache keys, de-duplication
SHA-1160 bits (40 hex)Broken for securityGit object IDs, legacy systems only
SHA-256256 bits (64 hex)SecureFile checksums, signatures, APIs, blockchains
SHA-384384 bits (96 hex)SecureTLS cipher suites, Subresource Integrity
SHA-512512 bits (128 hex)SecureHigh-security applications, often faster on 64-bit CPUs

Practical collisions have been demonstrated for both MD5 and SHA-1, which means an attacker can create two different inputs with the same hash. They are still fine for detecting accidental corruption, but use SHA-256 or stronger whenever security matters.

Do not hash passwords with these

General-purpose hashes are designed to be fast, which makes them bad for storing passwords: an attacker can try billions of guesses per second. Password storage should use a slow, salted algorithm built for the job — Argon2id, scrypt, bcrypt or PBKDF2.

Verify a hash

Paste a published hash into Compare with and the tool tells you whether it matches any of the five algorithms, ignoring upper/lower case. Note that this page hashes text, encoded as UTF-8. A file's checksum is computed from its raw bytes, so to verify a downloaded file use shasum -a 256 file (macOS/Linux) or certutil -hashfile file SHA256 (Windows).

Hashing runs locally: SHA algorithms use your browser's Web Crypto API and MD5 is computed in JavaScript. Your text is never uploaded.

Frequently asked questions

Can a hash be decrypted?
No. Hashing is one-way. Websites that claim to "decrypt" MD5 are looking the hash up in a database of previously hashed common words, which only works for weak, common inputs.
Why does my hash differ from another tool?
Usually because of invisible differences in the input: a trailing newline, a space, Windows line endings, or a different text encoding. This tool hashes exactly what is in the box as UTF-8.
Is MD5 still safe to use?
Not for security. Use it only for non-security tasks like checksums against accidental corruption. Use SHA-256 for anything security-related.
What is the hash of an empty string?
Every algorithm has a fixed hash for empty input. For example, the SHA-256 of an empty string is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.

Related tools

Password Generator, Base64 Encode/Decode, Text to Hex, UUID Generator.