Hash Generator - MD5, SHA-1, SHA-256, SHA-512 at a glance
- What it does
- Generate MD5, SHA-1, SHA-256 and SHA-512 hashes from any text in your browser. Verify downloads, compare checksums and check file integrity privately.
- Where it runs
- Entirely in your browser — no data is uploaded
- Works offline
- Yes, once the page has loaded
- Cost
- Free, with no account and no usage limit
- Category
- Developer & Code
How to use the hash generator
- Paste or type your input. Every algorithm updates at once, so you can compare them side by side.
- Copy the digest you need. Output is lowercase hexadecimal, the format almost every checksum file uses.
- To verify a download, paste the publisher's expected checksum next to the one you computed and compare character by character - or simply check that both strings are identical.
Hashing is one-way by design. There is no button to reverse a digest back into the original text, here or anywhere else. Sites claiming to "decrypt" MD5 are looking the value up in a table of previously seen inputs.
Which algorithm should you use
| Algorithm | Output | Status | Use for |
|---|---|---|---|
| MD5 | 128 bits, 32 hex chars | Broken since 2004 | Non-security checksums, cache keys, deduplication. |
| SHA-1 | 160 bits, 40 hex chars | Broken in practice since 2017 | Legacy compatibility only. Git uses it for object IDs, not for security. |
| SHA-256 | 256 bits, 64 hex chars | Recommended | Signatures, certificates, download verification, blockchain, general use. |
| SHA-512 | 512 bits, 128 hex chars | Recommended | Same uses as SHA-256; often faster on 64-bit hardware. |
"Broken" here means a collision attack exists: someone can construct two different inputs with the same digest. That defeats the use of MD5 and SHA-1 for signatures and tamper detection. It does not let an attacker reverse a specific hash, which is why MD5 survives as a checksum for accidental corruption.
Why you must not hash passwords with these
MD5, SHA-1, SHA-256 and SHA-512 are designed to be fast. That is exactly wrong for passwords: modern GPUs compute billions of SHA-256 hashes per second, so a leaked table of unsalted SHA-256 password hashes falls to a dictionary attack almost immediately.
Password storage needs a deliberately slow, salted, memory-hard function. In order of preference: Argon2id, scrypt, bcrypt, or PBKDF2 with a high iteration count where a standard requires it. All of them generate a unique salt per password and let you raise the cost as hardware improves.
If you are building authentication, do not hash passwords with a general-purpose hash - not even with a salt bolted on. Use your platform's password-hashing library.
Verifying a download
Publishers post a checksum so you can confirm a file was not corrupted in transit or swapped by a mirror. On the command line:
# macOS / Linux
shasum -a 256 ubuntu.iso
# Windows PowerShell
Get-FileHash ubuntu.iso -Algorithm SHA256Compare that against the published value. A mismatch means the file differs - re-download before you run it. Note that a checksum hosted on the same server as the file proves only integrity, not authenticity: if the server was compromised, both were replaced. A detached GPG signature is what proves origin.
Everyday uses that are not security
- Cache busting and content addressing - naming a build artefact after the hash of its contents so it can be cached forever.
- Deduplication - identifying identical files in a backup or media library without comparing them byte by byte.
- Change detection - hashing a config file or an API response to decide whether anything needs reprocessing.
- ETags - the HTTP header servers use to answer "has this resource changed since you last asked".
Frequently asked questions
No. A hash discards information - arbitrary-length input becomes fixed-length output - so the original cannot be recovered. What attackers do instead is guess: hash enormous lists of likely inputs and look for a match. Short or common inputs fall quickly, which is why salting exists.
It is unusable wherever an adversary might construct the input, because collisions are cheap to produce. It is still perfectly serviceable for detecting accidental corruption, deduplicating files, or as a cache key.
Usually a trailing newline, or a difference in character encoding. Hashing hello and hello\n gives entirely different digests, and a file saved with Windows line endings hashes differently from the same file with Unix endings.
No. The digests are computed with the Web Crypto API on your own device, so nothing you paste leaves the browser.
Random data mixed with an input before hashing, stored alongside the result. It ensures two users with the same password get different hashes, which defeats precomputed rainbow tables. Password-hashing functions generate and manage salts for you.
Nothing you enter here leaves your browser
Hash Generator - MD5, SHA-1, SHA-256, SHA-512 does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because API responses, tokens and configuration files are exactly the kind of thing that should not be posted to someone else’s server for formatting.
You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.