A hash generator turns any text into a fixed-length fingerprint — a hex digest — using a one-way hash function, and this tool computes MD5, SHA-1, SHA-256 and SHA-512 side by side as you type. Enter text on the left and every digest updates live; each result has its own Copy button and the status line shows the byte length of your input. Everything runs in your browser: the SHA algorithms use the built-in Web Crypto API and MD5 uses a small bundled JavaScript routine, so nothing you type is ever uploaded, logged, or stored.
What is a cryptographic hash?
A hash function takes an input of any size and returns a fixed-size value called a digest or hash. The same input always produces the same digest, a tiny change in the input produces a completely different digest, and — crucially — you cannot work backwards from the digest to the original input. That one-way property is what makes hashes useful for verifying integrity: publish the hash of a file, and anyone can re-hash their copy to confirm it arrived unchanged.
The tool above hashes the exact UTF-8 bytes of your text. That detail matters: hashing is defined over bytes, not characters, so the encoding you use determines the result. Two tools that disagree on a digest almost always disagree on encoding or on a hidden trailing newline.
MD5 vs SHA-1 vs SHA-256 vs SHA-512
The four algorithms here differ mainly in digest length and in whether they are still considered secure:
| Algorithm | Digest length | Hex characters | Security status |
|---|---|---|---|
| MD5 | 128-bit | 32 | Broken — collisions are practical |
| SHA-1 | 160-bit | 40 | Broken — collisions are practical |
| SHA-256 | 256-bit | 64 | Secure (SHA-2 family) |
| SHA-512 | 512-bit | 128 | Secure (SHA-2 family) |
A longer digest means more possible outputs, which makes an accidental collision — two different inputs sharing a digest — vanishingly unlikely. But length is not the whole story. MD5 and SHA-1 are broken not because they are short but because their internal design has been defeated: researchers can deliberately construct two different inputs with the same digest. SHA-256 and SHA-512 belong to the SHA-2 family and have no known practical collision attack. SHA-512 works on 64-bit words and is frequently faster than SHA-256 on modern 64-bit CPUs, despite producing a larger digest.
Important: what these hashes are not for
MD5 and SHA-1 must not be used for security. Because forging a collision is practical, they are unsafe for digital signatures, TLS certificates, software-signing, or anything where an attacker benefits from two inputs colliding. They remain perfectly fine for non-adversarial jobs: verifying that a download was not corrupted in transit, deduplicating files, or generating cache keys, where the only threat is accidental change.
No general hash — not even SHA-256 or SHA-512 — is password hashing. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt, or Argon2, run on the server. A plain fast hash of a password can be reversed with a wordlist in moments, and an unsalted hash lets identical passwords be spotted across users. If you are storing user passwords, reach for a password-hashing function with a per-user salt, not the digests on this page.
Common use cases
- File integrity — compare a download against a published SHA-256 checksum to confirm it was not corrupted or tampered with.
- Deduplication — hash records or files and treat matching digests as duplicates.
- Cache keys and ETags — derive a short, stable identifier from content that changes whenever the content does.
- Content addressing — reference a blob by its hash, the way Git identifies commits and objects.
A worked example
Type abc into the tool and you will get the MD5 digest 900150983cd24fb0d6963f7d28e17f72 and the SHA-256 digest ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Change a single character — say to abd — and both digests change completely, with no resemblance to the originals. That avalanche effect is exactly why hashes are good at detecting even the smallest change to a file or message.
Runs entirely in your browser
This tool makes no network requests. SHA-1, SHA-256 and SHA-512 are computed with crypto.subtle.digest, the browser’s native cryptography, and MD5 is computed by a compact routine included in the page because MD5 is not part of the Web Crypto standard. You can load the page, disconnect from the internet, and every digest still generates instantly — a good habit for any input you would rather not send across a network.