Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text simultaneously. Everything is computed in your browser.
Your data never leaves your browser. This tool runs entirely on your device.
Enter some text to see its hash in every algorithm.
What a hash function does
A cryptographic hash turns input of any size into a fixed-length digest. The same input always gives the same digest, and changing a single bit changes roughly half the output bits — the avalanche effect.
The operation is one-way by design. There is no "unhashing": recovering the input means guessing candidates and hashing them until one matches, which is exactly how password cracking works.
Which algorithm to use
MD5 and SHA-1 are both cryptographically broken. Collisions — two different inputs with the same digest — can be produced deliberately, so neither is safe for signatures, certificates or anything security-relevant.
They remain perfectly usable for non-security work: verifying a download against a published checksum, deduplicating files, or matching a legacy database column. SHA-256 is the right default for anything new.
- MD5 — broken, but fine for checksums and legacy compatibility.
- SHA-1 — broken since 2017. Still used by Git for object ids.
- SHA-256 — the current general-purpose standard.
- SHA-384 / SHA-512 — wider digests; SHA-512 is faster on 64-bit hardware.
Never hash passwords this way
Fast hashes are the wrong tool for passwords precisely because they are fast: a modern GPU computes billions of SHA-256 digests per second, so a stolen database of hashed passwords falls quickly.
Passwords need a deliberately slow, salted algorithm designed for the job — bcrypt, scrypt or Argon2. Adding a salt to SHA-256 helps but does not fix the speed problem.
Privacy
Hashing runs entirely in your browser. SHA digests use the built-in SubtleCrypto API and MD5 is computed locally, so nothing you paste is transmitted or logged.
Frequently asked questions
Can a hash be reversed?
Not directly. Hashing is one-way. What attackers do instead is guess: hash billions of candidate inputs and compare. Short or common inputs fall quickly, which is why "decrypt MD5" sites are really just lookup tables.
Is MD5 still safe to use?
Not for security. Collisions can be generated in seconds, so it must not be used for signatures, certificates or integrity against a deliberate attacker. It is still fine for detecting accidental corruption or matching legacy data.
Should I use SHA-256 for storing passwords?
No. It is far too fast — a GPU can try billions of guesses per second. Use bcrypt, scrypt or Argon2, which are deliberately slow and take a salt and a work factor.
Why do two different files sometimes give the same hash?
That is a collision. For MD5 and SHA-1 they can be constructed deliberately. For SHA-256 no collision has ever been found, and finding one by chance is not physically plausible.
Is my input sent anywhere?
No. SHA hashes use your browser's built-in SubtleCrypto API and MD5 is computed in JavaScript on your device. The page makes no network request with your text.
Related tools
- Password GeneratorGenerate a strong random password using your browser's cryptographic random source. Nothing is transmitted, logged or stored — the password exists only on your device.
- Base64 EncoderEncode any text to Base64, including emoji and non-Latin scripts. Switch to the URL-safe alphabet when the result has to travel in a URL.
- UUID GeneratorGenerate UUIDs in bulk. Version 4 is fully random; version 7 begins with a timestamp so the values sort chronologically. Both use your browser's secure random source.
- JWT DecoderPaste a JSON Web Token to read its header and payload. Timestamp claims are expanded into readable dates, and the token never leaves your browser.
- Chmod CalculatorTick the permissions you want and get the command to run. Converts between octal modes such as 755 and symbolic ones such as rwxr-xr-x, in both directions.