Hash Generator

What is a hash?

A cryptographic hash function turns an input of any length into a fixed-length value that is practically impossible to reverse and that changes completely when a single bit of the input changes. Hashes are used to check that data arrived intact, to compare two things without storing either, and — with a purpose-built function and a salt — to store passwords.

This tool computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of the same input at once, so you can match whichever one a system expects. Hashing is one-way by construction: the input is not kept inside the digest, so the original text cannot be recovered from it — by this page or by any other.

Collisions in the MD5 hash function can be found within seconds on a commodity PC.

RFC 6151 §2.1

Features

Five algorithms at once: The same input is hashed with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 simultaneously, which saves guessing which one a legacy system used.
Says which algorithms are broken: MD5 and SHA-1 have practical collision attacks and are marked as such next to their output — usable for checksums, unfit for signatures or passwords.
UTF-8 correct: Input is hashed as UTF-8 bytes, so hashes of Korean or emoji text match what a server computes from the same string.
Nothing leaves the page: SHA hashes use the browser's own Web Crypto implementation and MD5 runs in JavaScript here. The text you hash is never transmitted.

How to use

1
Type or paste the text
Enter the value you want to hash. All five digests update as you type.
2
Pick the algorithm you need
Match whatever the other system expects — SHA-256 is the sensible default for anything new.
3
Copy the digest
Each row has its own copy button.

Frequently asked questions

Can the original text be recovered from a hash?

No. A hash function is one-way by design: the input is not stored inside the output, so there is nothing to recover. This is the property that makes hashing useful for integrity checks and unsuitable as a way to store anything you need to read back later — for that you want encryption, which is reversible with a key.

Is MD5 still safe to use?

Not for anything security-related. Practical collision attacks against MD5 have existed since 2004, meaning two different inputs can be made to produce the same digest. It remains fine for non-adversarial uses such as verifying an accidental file corruption, deduplicating content, or matching a legacy value like a Gravatar hash.

Which hash should I use?

SHA-256 for general integrity checking and signatures. For passwords, none of these: use a deliberately slow, salted password hash such as Argon2id, scrypt, or bcrypt — a fast hash is exactly the wrong tool, because speed helps the attacker.

Why do two tools give different hashes for the same text?

Almost always a difference in the exact bytes being hashed rather than in the algorithm: a trailing newline, CRLF versus LF line endings, or a different text encoding. This tool hashes the input as UTF-8, with no newline added.

What is the difference between hashing and encryption?

Encryption is reversible with a key — it is meant to be undone by whoever holds it. Hashing is not reversible by anyone, has no key, and produces a fixed-size output. If you need to get the data back, you want encryption, not a hash.

Is my input sent to a server?

No. SHA digests are computed by the browser's Web Crypto API and MD5 by JavaScript on this page. The page has no backend to send anything to.

If you hit this

Specifications this follows

RFC 1321 — The MD5 Message-Digest Algorithm — The algorithm implemented here, verified against the test vectors in Appendix A.5.
RFC 6151 — Updated Security Considerations for MD5 and HMAC-MD5 — Why MD5 must not be used where collision resistance matters.
FIPS 180-4 — Secure Hash Standard — Defines SHA-1, SHA-256, SHA-384 and SHA-512, which the browser computes via Web Crypto.
OWASP — Password Storage Cheat Sheet — Why none of these belong anywhere near a password — use Argon2id, scrypt or bcrypt.