Hash generator
MD5, SHA-1, SHA-256 and SHA-512 hashes of any text.
FreeRuns in your browserNo signupUpdated 2026-10-29
A hash is one-way: it cannot be reversed to get the text back. The same input always gives the same hash.
Status
Working…
Text input
Input size
43 B
Bytes hashed
SHA-256
–
First 16 hex characters
Digests (hex)
| Algorithm | Hash | |
|---|---|---|
| MD5128-bit | … | |
| SHA-1160-bit | … | |
| SHA-256256-bit | … | |
| SHA-512512-bit | … |
MD5 and SHA-1 are fine for checksums and cache keys but broken for signatures and password storage. For passwords use bcrypt, scrypt or Argon2, never a plain hash.
About this tool
How it works and how to read the result.
Need this done for you?
Web app & SaaS development
SaaS products and web apps, from first version to scale.
See the serviceWhat it does
The SHA-256 hash generator computes MD5, SHA-1, SHA-256 and SHA-512 digests of any text or any file, as hex, with a copy button for each. SHA digests come from the browser's Web Crypto API; MD5 is a small built-in implementation because Web Crypto does not include it. Text is hashed as UTF-8 bytes, so results match command-line tools such as sha256sum and md5. Files are read locally and never uploaded, which makes it a quick way to verify a download against the checksum printed on a release page.
How to use it
- Type or paste the text to hash. The digests update as you type.
- Or choose a file. The text box is ignored while a file is loaded, and the file name shows in the status card.
- Tick uppercase if the checksum you are comparing against is in capitals.
- Copy the digest you need, or compare it by eye against the published value.
How to read the result
Each digest is a fixed length no matter how long the input: MD5 is 32 hex characters, SHA-1 is 40, SHA-256 is 64 and SHA-512 is 128. The sentence "The quick brown fox jumps over the lazy dog" is 43 bytes and gives the MD5 9e107d9d372bb6826bd81d3542a419d6, a value you will find in many textbooks, which is a handy way to confirm your copy is exact. Add a full stop at the end and every character changes.
To verify a download, pick the file, then compare the SHA-256 with the one on the release page. The first and last few characters are usually enough to spot a mismatch, but check the whole string before trusting an installer. A mismatch means a corrupt or tampered file, not a wrong tool.
Do not use any of these for storing passwords; they are fast by design, which is the opposite of what password storage needs. Use bcrypt, scrypt or Argon2 on the server. Hashing for cache keys and deduplication is routine in our web app development work. To make secrets rather than check them, use the password generator.
Questions
Frequently asked.
Which hash should I use?
SHA-256 for almost everything new, including checksums, content addressing and signatures. SHA-512 is slightly faster on 64-bit machines and gives a longer digest. MD5 and SHA-1 are only for compatibility with systems that already use them; both have known collision attacks.
Can I get the original text back from a hash?
No. A hash is one-way by design. What attackers do instead is hash huge lists of likely inputs and look for a match, which is why short or common passwords are weak no matter which hash protects them, and why password storage needs a slow, salted algorithm.
Why does a one-letter change produce a totally different hash?
That is the avalanche property. Every bit of the output depends on every bit of the input, so "hello" and "Hello" share nothing. It is what makes a hash useful for detecting tampering: any change, however small, is obvious.
Your next move
Like what you see? Tell us about it.
A process that takes too long, a website that undersells you, or an idea ready to take shape. Tell us where you are and we will suggest a useful next step.
India · Working with clients worldwide