Hash Generator (MD5, SHA-1, SHA-256, SHA-512)

Generate a cryptographic hash of any text or file using MD5, SHA-1, SHA-256, or SHA-512, computed entirely in your browser using the Web Crypto API.

What hashing does, and why it’s not the same as encryption

A hash function takes any input — a word, a whole file, a password — and produces a fixed-length string of characters that acts as a kind of fingerprint for that exact input. Change even a single character of the input, and the entire hash output changes completely. Critically, hashing is one-way: there’s no way to reverse a hash back into its original input, which is the opposite of encryption (which is designed to be reversible with the right key). This is why passwords are stored as hashes, not encrypted text — even the system storing them shouldn’t be able to recover the original.

Different algorithms serve different purposes today:

• MD5 — fast but cryptographically broken; collisions (two different inputs producing the same hash) are practical to generate. Still widely used for non-security purposes like checking file integrity after a download, but should never be used for anything security-sensitive (passwords, signatures) anymore.
• SHA-1 — also cryptographically broken for security purposes as of well-documented collision attacks, though still seen in legacy systems (older Git internals, older certificates).
• SHA-256 — part of the SHA-2 family, currently considered secure and is the standard choice for most modern applications: blockchain, TLS certificates, password hashing (usually combined with a proper key-derivation function rather than raw), and file integrity verification.
• SHA-512 — similar security properties to SHA-256 but with a longer output and often faster on 64-bit systems, used where a longer hash or extra security margin is preferred.

How to use it

1. Choose text or file input mode.
2. For text: type or paste directly, and the hash for every selected algorithm updates live as you type.
3. For files: drag and drop any file, and the tool computes the hash without ever uploading the file’s contents — useful for verifying a large download’s integrity without waiting on an upload first.
4. Select which algorithm(s) to display — all four can be shown simultaneously for comparison, or you can narrow to just the one you need.
5. Copy any individual hash output, or copy all of them together in a labeled block for documentation purposes.

Common situations this solves

• Verifying a downloaded file hasn’t been corrupted or tampered with, by comparing its hash against the checksum published by the source (common for software downloads, ISO images, and installer files).
• Checking whether two files are identical without opening and comparing them byte-by-byte — if their hashes match, their contents are (for all practical purposes) identical.
• Generating a hash for use in code, such as creating a cache key, a deduplication identifier, or a content fingerprint for a CMS or database.
• Understanding how password hashing works for educational or debugging purposes, though note this tool computes raw hashes rather than the salted, iterated hashing (like bcrypt or Argon2) that real password storage systems should use.
• Confirming file integrity after a transfer, such as verifying a backup or a file moved between systems matches the original.

Frequently asked questions

Is it safe to hash a password with this tool to check something? This tool computes raw, unsalted hashes, which is not how passwords should actually be stored or verified in a real system — real password storage should use a dedicated password-hashing algorithm like bcrypt, scrypt, or Argon2, which are deliberately slow and use per-password salts to resist brute-force attacks. This tool is useful for understanding or debugging hash output generally, not as a substitute for proper password hashing infrastructure.

Why does MD5 still exist if it’s “broken”? MD5 being cryptographically broken means it’s no longer safe against a deliberate, malicious attacker trying to engineer a collision. It’s still fast and reliable for non-adversarial purposes, like a quick checksum to confirm an accidental file corruption during a transfer, where nobody is trying to intentionally fake a match.

Can two different files ever produce the same hash? In theory, yes — this is called a collision, and it’s mathematically unavoidable for any hash function since the input space is infinite and the output is fixed-length. For SHA-256, no practical collision has ever been found or is expected to be found with current computing power. For MD5 and SHA-1, practical collision attacks exist and have been demonstrated, which is exactly why they’re no longer recommended for security purposes.

Does the file’s name or file type affect the hash? No — the hash is computed purely from the file’s binary content. Renaming a file, or even changing its extension without altering the actual bytes, will not change its hash.

Why do I need SHA-512 if SHA-256 is already considered secure? For most purposes, SHA-256 is sufficient. SHA-512 offers a larger security margin and, on 64-bit hardware, is often computed faster despite the longer output, due to how its internal operations align with 64-bit word sizes — some systems choose it for that performance characteristic alone rather than because SHA-256 has a known weakness.