Hash Generator — MD5, SHA-1, SHA-256 & SHA-512
Need the hash of a piece of text? Type or paste it above and the tool instantly shows its MD5, SHA-1, SHA-256, and SHA-512 values — copy any of them with one click. The SHA hashes are computed with your browser's built-in Web Crypto API and MD5 with a standard local routine, so your text is never sent, logged, or stored anywhere.
Hashes
—
—
—
—
What is a hash?
A hash function takes any input — a word, a paragraph, a whole file — and turns it into a short, fixed-length string of characters called a digest. Good hash functions share three useful properties:
- Deterministic: the same input always produces the same hash.
- Fixed length: the digest is the same size no matter how big the input is.
- One-way: you can't reverse a hash back into the original text.
- Avalanche effect: change a single character and the entire hash changes completely.
MD5, SHA-1, SHA-256 and SHA-512
These are the most widely used hash algorithms, and they differ mainly in digest length and security:
| Algorithm | Digest length | Status |
|---|---|---|
| MD5 | 128-bit (32 hex) | Fast but broken — fine for checksums, not for security. |
| SHA-1 | 160-bit (40 hex) | Deprecated for security; collisions are known. |
| SHA-256 | 256-bit (64 hex) | Strong and recommended for most uses today. |
| SHA-512 | 512-bit (128 hex) | Strong, with a longer digest than SHA-256. |
What hashes are used for
- File integrity / checksums: compare a file's hash against a published one to confirm it downloaded correctly and wasn't tampered with.
- Detecting changes: a different hash means the content changed, even by one character.
- Deduplication and indexing: identical content produces identical hashes.
- Digital signatures and certificates: these sign a hash of the data rather than the whole thing.
Important: hashing is not encryption — or password storage
Hashing is one-way: it is not encryption, and there is no "decrypt" because no key is involved. It also is not how you should store passwords on its own. A plain MD5 or SHA-256 of a password can be cracked quickly with lookup tables. Proper password storage uses a slow, salted algorithm such as bcrypt, scrypt, or Argon2. To create strong passwords in the first place, use our password generator.
Frequently asked questions
Is my text sent to a server?
No. All hashing happens in your browser — SHA via the Web Crypto API, MD5 via a local routine. Nothing you type is transmitted, logged, or stored.
Which hash should I use?
For anything security-related, use SHA-256 (or SHA-512). Use MD5 or SHA-1 only for non-security tasks like quick checksums, and only when something specifically requires them.
Can a hash be reversed?
No. Hashes are one-way. So-called "MD5 decrypt" sites simply look the hash up in a database of pre-computed common values — they aren't reversing the math.
Why did two different texts produce the same hash?
For strong algorithms that effectively never happens. Such a "collision" is only feasible with broken algorithms like MD5 and SHA-1, which is exactly why they shouldn't be relied on for security.
More tools
Password Generator — Generate strong, random passwords and memorable passphrases in seconds. Pick the length and character sets you want and copy your password instantly — everything runs locally in your browser, so nothing is ever sent, logged, or stored.
PIN Generator — Generate random, secure PIN codes (3–12 digits) right in your browser. Avoid weak PINs like 1234 or 0000, create them in bulk, and copy with one click — nothing is sent anywhere.
Passphrase Generator — Create strong, memorable passphrases from random words — easy to remember, hard to crack. Choose the word count and separators, generate in bulk, all locally in your browser.
Password Strength Checker — Test your password strength instantly. See its entropy, estimated time to crack, and exactly what to fix — all checked locally in your browser, never sent anywhere.
Password Leak Check — Check whether your password has appeared in a known data breach. Thanks to k-anonymity, only the first five characters of its hash are ever sent — your password stays in your browser.