Hash Generator
Generate SHA-256, SHA-512, SHA-1, and MD5 hashes from any text.
How to Use
- Type or paste any text into the input field.
- All hash values update automatically.
- Click the copy button next to any hash to copy it.
- Toggle uppercase/lowercase output as needed.
When to Use This
- Confirming that a configuration string pasted into two environments is byte-identical, by comparing SHA-256 digests rather than reading the text twice.
- Working out an ETag or cache key from a known input while debugging, so you can match what a server returns without re-running the application.
- Reproducing a legacy system's MD5 digest to find out why a lookup is missing, when the format predates anything better and cannot be changed.
- Verifying a short published fingerprint, such as a token or key digest quoted in documentation, against the value you actually hold.
Frequently Asked Questions
About This Tool
A cryptographic hash maps input of any length onto a fixed-length digest. Three properties make one useful: it cannot be inverted, you cannot find a second input matching a given digest, and you cannot find any two inputs that collide. MD5 and SHA-1 have lost that third property, with collisions now producible on ordinary hardware, which is why certificate authorities and signature formats abandoned both. SHA-256 and SHA-512, from the SHA-2 family, remain unbroken and are the sensible default.
Type into the box and all four digests recompute on each keystroke. SHA-1, SHA-256 and SHA-512 come from the browser's Web Crypto API, which encodes your text as UTF-8 before digesting it. MD5 is not offered by that API, so it uses a JavaScript implementation bundled with the page. Output is hexadecimal with an uppercase toggle, and nothing you type is sent anywhere.
Notes & Limits
- A plain digest is not password storage. Passwords need a slow salted function such as bcrypt, scrypt or Argon2, because a GPU computes billions of raw SHA-256 hashes per second.
- Never use MD5 or SHA-1 where an adversary can influence the input. Practical collisions exist for both, which rules them out for signatures, certificates and tamper-evident deduplication.
- The MD5 routine keeps only the low byte of each character, so non-ASCII text produces a Latin-1 digest that will not match a standard UTF-8 MD5. The three SHA values use UTF-8 and will.
- The input is a text box, so there is no file hashing. To check a downloaded ISO or installer against a published checksum, use sha256sum, shasum or certutil locally.