Hash Generator

About Hash Generator

A hash generator computes a fixed-length fingerprint of your text using a hash function. Type or paste text and get its MD5, SHA-1, SHA-256, SHA-384, or SHA-512 digest instantly. The same input always produces the same hash, and your text is never uploaded — everything runs in your browser.

What a hash is and is not

A hash function takes input of any length and returns a fixed-length digest — 32 hex characters for MD5, 64 for SHA-256. The same input always gives the same output, and changing a single bit changes roughly half the output bits, an effect called the avalanche property. That is what makes a hash useful as a fingerprint: two files that differ anywhere at all produce completely unrelated digests.

Hashing is one-way and lossy. There is no decode operation, because the original data is not in there to recover — a one-gigabyte file and a single character both compress to the same 64 characters. Anyone offering to reverse a hash is really looking the value up in a table of precomputed common inputs, which works for short passwords and never for arbitrary data.

MD5 and SHA-1 are broken — for some purposes

Both are broken against collision attacks: it is computationally practical to construct two different inputs with the same digest. This has been demonstrated with real files, including a pair of PDFs with identical SHA-1 hashes. That makes both unfit for anything where an adversary chooses the input — digital signatures, certificates, verifying a download has not been tampered with.

They are not broken for non-adversarial uses. As a checksum against accidental corruption, a cache key, or a way to spot duplicate files in your own storage, MD5 is fast and perfectly serviceable. The distinction is whether someone benefits from engineering a collision. If yes, use SHA-256; if the only threat is a flipped bit on a disk, MD5 is fine.

Never hash a password with these

General-purpose hash functions are designed to be fast, which is precisely wrong for passwords. Modern hardware computes billions of SHA-256 digests per second, so an attacker with a leaked table of hashed passwords can test enormous dictionaries very cheaply. Adding a salt stops precomputed rainbow tables but does nothing about raw speed.

Password storage needs a deliberately slow, memory-hard function — Argon2id, scrypt, or bcrypt — with a work factor tuned so a single verification takes a meaningful fraction of a second. That is negligible for your login form and ruinous for someone trying billions of guesses. This is a different tool for a different job; the hashes here are for fingerprinting data, not for storing credentials.

Verifying a download

The everyday use is checking a file arrived intact. A project publishes the SHA-256 of its release; you hash your copy and compare. If the two strings match character for character, your file is byte-identical to the one they built. If they differ at all, it is corrupt or has been substituted — there is no partial match.

One caveat worth understanding: this only proves your file matches the digest you were given. If an attacker can alter the download, they can usually alter the page showing the digest too. That is why serious projects sign their checksum file with a cryptographic key published separately. Comparing a hash against a value from the same compromised source proves nothing.

Frequently asked questions

Which hash algorithm should I use?

SHA-256 is the modern default for integrity checks and fingerprints. SHA-384 and SHA-512 give longer digests for stronger margins. MD5 and SHA-1 are fast but broken for security — use them only for non-security checksums or compatibility with old systems.

Is MD5 safe to use?

Not for security. MD5 is fast and fine for non-security checksums like file fingerprints or cache keys, but it's cryptographically broken — attackers can craft collisions — so never use it for passwords, signatures, or anything an adversary could target. Use SHA-256 there.

Can I reverse a hash back to the original text?

No. Hashes are one-way by design — you can't recover the input from the digest. A hash is a fingerprint, not encryption, so there's no key that decodes it.

Is my text uploaded to a server?

No. Hashing runs entirely in your browser — your text never leaves your device.