Hash Generator

What a hash is

A cryptographic hash function takes input of any length and produces a fixed-length string of hexadecimal digits called a digest. The same input always gives the same digest; a one-character change produces a completely different one; and there is no practical way to work backwards from the digest to the input. This tool computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text you enter, in your browser, without sending the text anywhere.

"hello"  →  MD5      5d41402abc4b2a76b9719d911017c592
"hello"  →  SHA-256  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
"Hello"  →  SHA-256  185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

The last two lines differ only by the case of one letter, yet share no visible pattern. That property — the “avalanche effect” — is what makes hashes useful for detecting changes.

The algorithms compared

Algorithm	Digest length	Year	Status
MD5	128 bits (32 hex)	1992	Broken — collisions trivial; checksums only
SHA-1	160 bits (40 hex)	1995	Broken — practical collision shown 2017; being retired
SHA-256	256 bits (64 hex)	2001	Secure; the default choice
SHA-384	384 bits (96 hex)	2001	Secure; SHA-512 truncated
SHA-512	512 bits (128 hex)	2001	Secure; faster than SHA-256 on 64-bit CPUs

“Broken” means someone can deliberately construct two different inputs with the same digest (a collision). It does not mean the digest can be reversed, so MD5 and SHA-1 remain fine for non-adversarial uses like detecting accidental file corruption. For anything involving security — signatures, certificates, integrity of downloads from untrusted sources — use SHA-256 or stronger.

What hashes are used for

File integrity. Software downloads publish a SHA-256 alongside the file. Hash your copy and compare; a single flipped bit during transfer changes the digest entirely.
Detecting duplicates. Two files with the same SHA-256 are, for all practical purposes, identical. Backup and deduplication systems rely on this.
Digital signatures and certificates. A document is hashed and the hash is signed with a private key; verifying the signature proves the document has not changed.
Git and version control. Every commit, tree and file in Git is addressed by its SHA-1 (migrating to SHA-256), which is why history cannot be altered silently.
Blockchains. Bitcoin's proof-of-work searches for a block whose double-SHA-256 digest falls below a target; each block also commits to the previous block's hash.
Cache keys and ETags. Web servers and CDNs hash content to decide whether a cached copy is still current.

Hashing passwords — do not use these directly

A plain SHA-256 of a password is not secure storage. Fast hashes are designed to be fast; a modern GPU computes billions of SHA-256 hashes per second, which means a leaked table of hashed passwords can be brute-forced quickly, and precomputed “rainbow tables” already cover common passwords. Password storage needs a function that is deliberately slow and salted:

Argon2id — current recommendation; memory-hard, configurable cost.
bcrypt — widely deployed, still adequate with a cost factor of 10 or more.
scrypt / PBKDF2 — acceptable when Argon2 or bcrypt is unavailable; PBKDF2 needs a high iteration count (600,000+ for SHA-256 per current OWASP guidance).

A salt is a random value stored alongside each hash so that two users with the same password have different hashes and rainbow tables become useless. All the functions above handle salting for you.

Hash vs encryption vs encoding

	Reversible?	Needs a key?	Purpose
Hashing (SHA-256)	No	No	Integrity, fingerprinting
Encryption (AES)	Yes, with the key	Yes	Confidentiality
Encoding (Base64)	Yes, by anyone	No	Safe transport of binary data

People often say “encrypt” when they mean “hash”. If you need to get the original back, you need encryption; if you only need to check that something matches, hashing is the right tool. Base64 provides no protection at all — it is just a different way of writing the same bytes.

Frequently asked questions

Can a hash be decrypted?

No. Hashing is one-way. Services that claim to 'decrypt' MD5 or SHA-1 are looking the digest up in a database of previously hashed inputs — which works for common passwords and short strings, and is precisely why fast hashes must not be used for password storage.

Which algorithm should I use?

SHA-256 unless you have a specific reason otherwise. Use SHA-512 if you are on 64-bit hardware and want more speed or margin; MD5 only when interoperating with a legacy system that expects it.

Why does the same text give a different hash on another site?

Almost always a trailing newline or different whitespace, or a difference in text encoding (UTF-8 vs UTF-16). This tool hashes the exact UTF-8 bytes of what you enter with no added newline.

How do I hash a file rather than text?

On macOS or Linux: shasum -a 256 filename. On Windows PowerShell: Get-FileHash filename. Browser-based hashing of large files is possible but this tool is designed for text.

Are two different inputs ever going to give the same SHA-256?

In theory yes, because inputs are unlimited and outputs are 256 bits. In practice, no collision has ever been found, and the expected effort to find one by brute force (about 2¹²⁸ operations) is far beyond any conceivable computing capacity.

Is HMAC the same as a hash?

HMAC combines a hash function with a secret key to produce a message authentication code. It proves both integrity and that the sender knew the key — used for API request signing and webhook verification. A plain hash proves only integrity.