How to use the hash generator
Type or paste text and all five hashes update as you type. Each one has its own copy button. The text is converted to UTF-8 bytes before hashing, which matches the behaviour of sha256sum, Python's hashlib and nearly every server-side library. Watch out for invisible differences: a trailing newline or a Windows line ending produces a completely different hash.
The SHA family is calculated with the browser's Web Crypto API (crypto.subtle.digest). MD5 isn't included in Web Crypto because it's considered broken, so we compute it with a small built-in implementation for compatibility with older systems.
What a hash is
A cryptographic hash function turns input of any size into a fixed-size fingerprint. The same input always gives the same output, a tiny change in the input changes the output completely, and there's no practical way to go backwards from the hash to the input. That makes hashes useful for:
- Checking downloads. Compare the SHA-256 published by the project with the one you calculate.
- Cache keys and deduplication. Two files with the same hash have the same content.
- Content addressing. Git identifies every commit and file by its hash.
- Signing. Digital signatures and HMACs sign a hash of the message.
Which algorithm should I use?
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 128 bits | Broken for security. Fine for non-adversarial checksums. |
| SHA-1 | 160 bits | Collisions demonstrated in 2017. Avoid for anything new. |
| SHA-256 | 256 bits | The sensible default today. |
| SHA-384 / SHA-512 | 384 / 512 bits | Larger security margin; SHA-512 is often faster on 64-bit CPUs. |
Don't hash passwords with these
General-purpose hashes are designed to be fast, which is exactly what you don't want for passwords. A modern GPU can try billions of SHA-256 guesses per second. To store passwords, use a deliberately slow, salted algorithm such as Argon2id, bcrypt or scrypt. And if you need to prove a message came from you, use an HMAC or a digital signature rather than a plain hash.
Frequently asked questions
Can a hash be reversed or decrypted?
No. Hashing is one-way. Sites that claim to "decrypt" MD5 are looking the hash up in a database of common inputs, which only works for short or predictable text.
Why is my hash different from another tool?
Usually because of invisible characters: a trailing newline, spaces, or different line endings. Also check that both tools use UTF-8.
Why do I see "Needs HTTPS"?
Browsers only expose the Web Crypto API on secure (HTTPS or localhost) pages. The live site always uses HTTPS.