Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text at once, live as you type. Text is hashed as UTF-8 and results are shown in lowercase hexadecimal.
Click any hash value to copy it. Copied
What is a hash?
A cryptographic hash function turns input of any length into a fixed-length value, the digest. The same input always gives the same digest, a one-character change gives a completely different one, and there is no way to work backwards from the digest to the input. This page computes five of them at once: MD5, defined in RFC 1321, and SHA-1, SHA-256, SHA-384 and SHA-512, defined in FIPS 180-4.
Your text is converted to UTF-8 bytes and hashed, and each digest is shown in lowercase hexadecimal. The SHA family is computed with the browser’s Web Crypto API (crypto.subtle.digest); MD5 is not part of that API, so it is calculated by JavaScript on this page.
How to use the hash generator
- Type or paste text into the Input box. All five hashes update as you type; there is no button to press.
- Click any hash value to copy it. “Copied” appears next to the hint below the results.
- Delete the text to reset the results to a dash.
The tool hashes text only. It has no file upload, so to check a downloaded file use a command-line tool such as sha256sum file.iso on Linux or shasum -a 256 file.iso on macOS.
The five algorithms compared
| Algorithm | Digest size | Hex length | Collision resistance |
|---|---|---|---|
| MD5 | 128 bits | 32 | Broken: collisions can be produced cheaply |
| SHA-1 | 160 bits | 40 | Broken: a practical collision was published in 2017 |
| SHA-256 | 256 bits | 64 | No known practical attack |
| SHA-384 | 384 bits | 96 | No known practical attack; a truncated SHA-512 variant |
| SHA-512 | 512 bits | 128 | No known practical attack |
Verified examples
| Input | MD5 | SHA-256 |
|---|---|---|
hello | 5d41402abc4b2a76b9719d911017c592 | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
Hello | 8b1a9953c4611296a827abf8c47804d7 | 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 |
hello + line break | b1946ac92492d2347c6235b4d2611184 | 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03 |
café | 07117fe4a1ebd544965dc19573183da2 | 850f7dc43910ff890f8879c0ed26fe697c93a067ad93a7d50f466a7028a9bf4e |
One capital letter or one invisible line break changes the whole digest. The same values come from the command line, provided you do not add a newline:
printf '%s' 'hello' | sha256sum # 2cf24dba…9824
echo 'hello' | sha256sum # 5891b5b5…be03 (echo adds \n)Getting the same hash in code
These produce the SHA-256 value shown above for hello. All three hash the UTF-8 bytes of the string, just like this page:
// Browser, Web Crypto API (inside an async function)
const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode('hello'));
const hex = [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, '0')).join('');
// Node.js
require('crypto').createHash('sha256').update('hello', 'utf8').digest('hex');
# Python
hashlib.sha256('hello'.encode('utf-8')).hexdigest()When to use which
| Task | Use | Avoid |
|---|---|---|
| Checking a download against a published checksum | Whatever the publisher lists, usually SHA-256 | Comparing against a checksum from the same untrusted mirror |
| Storing user passwords | A slow, salted password hash: Argon2id, scrypt, bcrypt or PBKDF2 | All five hashes on this page; they are designed to be fast, which helps attackers |
| Signing an API request with a shared secret | HMAC-SHA-256 (RFC 2104) | Plain SHA-256(secret + message), which is open to length-extension attacks |
| Cache keys, ETags, de-duplication of trusted data | Any of them; MD5 and SHA-1 are fine where nobody gains from a collision | MD5 or SHA-1 when an attacker controls the input |
| Signatures and certificates | SHA-256 or stronger | MD5 and SHA-1 |
Why your hash does not match another tool
- Line endings. A trailing newline, or Windows
\r\ninstead of\n, changes the bytes and therefore the hash. Browsers store line breaks in a text box as\n, so text pasted here is hashed with\nline endings even if the original file used\r\n. - Character encoding. This tool always uses UTF-8. A system that hashes UTF-16 or Latin-1 bytes gets a different result for any non-ASCII text.
- Unicode normalisation.
écan be one code point oreplus a combining accent. They look identical but hash differently. - Output format. Some APIs show the digest in Base64 instead of hex: SHA-256 of
helloisLPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=in Base64. Upper- and lowercase hex are the same value.
Frequently asked questions
Can a hash be decrypted?
No, hashing is not encryption and there is no key. However, short or predictable inputs can be found by hashing guesses and comparing, and precomputed tables exist for common words. Hashing an email address or phone number therefore does not make it anonymous.
Why does the tool still offer MD5 and SHA-1?
Many existing systems use them for checksums, cache keys and file identifiers, and you often need to reproduce a value they produced. They remain fine for detecting accidental changes. They are not safe where someone could deliberately craft two inputs with the same hash, and NIST plans to retire SHA-1 entirely by 2030.
Why is nothing shown for empty input?
The results reset to a dash when the box is empty. Empty input does have a hash: d41d8cd98f00b204e9800998ecf8427e for MD5 and e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 for SHA-256. Seeing one of those in your own system usually means something hashed an empty string by mistake.
What does “unavailable” mean?
Browsers only provide crypto.subtle on secure pages (HTTPS or localhost). If the page is opened over plain HTTP, the SHA results show “unavailable” while MD5 still works.
Can I compute an HMAC here?
No, there is no key field, so every result is a plain hash. To check an HMAC-signed token, the JWT Decoder verifies HS256, HS384 and HS512 signatures with a secret you supply.
Is the text I hash sent anywhere?
No. Hashing happens in your browser and the input is not uploaded. Even so, treat a hash of a real password or API key as sensitive: anyone with the hash can test guesses against it.