Hash Generator
Generate cryptographic hashes (MD5, SHA1, SHA256, SHA384, SHA512) for text instantly.
Upload a .txt file (max 5MB)
How This Tool Actually Computes Each Hash
MD5 and the SHA family are computed differently under the hood here. Browsers don't expose MD5 through the native Web Crypto API (it was excluded for security reasons), so MD5 on this page runs on a hand-rolled JavaScript implementation of the RFC 1321 algorithm — real bitwise rotations and modular addition running in your tab. SHA-1, SHA-256, SHA-384, and SHA-512, by contrast, call the browser's built-in crypto.subtle.digest() (Web Crypto API), which runs the algorithm natively rather than in interpreted JavaScript — meaningfully faster and using audited browser cryptography rather than a reimplementation.
One easy-to-miss detail: the text you paste is .trim()'d before hashing. If you're checksumming a string to match against an external tool (a script, a command-line sha256sum, another site) and that tool doesn't trim whitespace, a trailing newline or space in your input can produce a hash that matches here but not there, or vice versa. When exact byte-for-byte matching matters, verify there's no incidental leading/trailing whitespace on either side.
What This Tool Is — and Isn't — For
- ✗ No salting: Every hash here is a plain, unsalted digest of exactly the text you enter — there's no salt input field. Two people hashing the same password here will always get the identical hash, which is precisely why raw MD5/SHA hashes should never be used to store real passwords: without a per-user salt, precomputed rainbow tables can reverse common passwords instantly.
- ✗ No HMAC or keyed hashing: This generates plain digests, not HMAC-SHA256 or similar message-authentication codes that require a secret key. If you need to verify a webhook signature or API request signing, you need HMAC support, not a plain hash.
- ✓ Good for what it's built for: checksums to confirm two pieces of text are byte-identical, generating cache-busting keys, spot-checking that a config value or API payload matches an expected fingerprint, or exploring how hash functions behave (e.g. the avalanche effect — try hashing "password" then "Password" and compare).
MD5 vs SHA-1 vs SHA-2: The Real Differences
MD5 — 128-bit output, 32 hex characters
Practical collisions (two different inputs producing the same hash) have been demonstrated since 2004 and can now be generated in seconds on ordinary hardware. That makes it unsafe anywhere an attacker could supply the input — but it's still perfectly fine as a fast checksum for detecting accidental corruption, like confirming a large file wasn't truncated during a transfer, where nobody is trying to forge a match.
SHA-1 — 160-bit output, 40 hex characters
Google and CWI Amsterdam demonstrated a practical SHA-1 collision (the "SHAttered" attack) in 2017. Git still uses SHA-1 for commit object IDs (transitioning to SHA-256 in newer versions), but it should not be chosen for anything new that needs collision resistance, like signing documents or verifying downloads from an untrusted source.
SHA-256 / SHA-384 / SHA-512 — the SHA-2 family
No practical collision attack is known against any SHA-2 variant. SHA-256 (64 hex characters) is the default for TLS certificates, Bitcoin block hashing, and most "verify this download" checksums today. SHA-384 and SHA-512 (96 and 128 hex characters) run on 64-bit words internally and are often faster than SHA-256 on 64-bit hardware despite the longer output — pick them when you want extra collision margin rather than for a meaningful speed tradeoff.
Reproducing a Hash from This Page in Code
If you need to confirm a hash generated here matches what your backend produces, here's the equivalent call for SHA-256 in a few common languages (remember: this tool trims input first, so match that on your side too if strings don't line up):
Node.js
const crypto = require('crypto');
const hash = crypto
.createHash('sha256')
.update(text.trim())
.digest('hex');
Python
import hashlib
hash = hashlib.sha256(
text.strip().encode()
).hexdigest()
PHP
$hash = hash('sha256', trim($text));
Java
MessageDigest md =
MessageDigest.getInstance("SHA-256");
byte[] hash = md.digest(
text.trim().getBytes());
Frequently Asked Questions
My hash doesn't match the one from a command-line tool — why?
The most common cause is whitespace: this tool trims leading/trailing whitespace from your input before hashing. Also double-check character encoding — this tool hashes the UTF-8 byte representation of your text, which matters if your string has accented or non-ASCII characters.
Can I salt a password hash with this tool?
No, there's no salt field — you'd just be hashing the concatenated salt+password text yourself, which is not equivalent to a proper salted password hashing scheme. For real password storage use a purpose-built algorithm like bcrypt, scrypt, or Argon2 on your server, which handle salting and computational cost automatically.
Is MD5 completely useless now?
Not for every purpose — it's still fine as a quick, fast checksum to catch accidental data corruption (e.g. confirming a large file copied correctly) where nobody is deliberately trying to fake a match. It's unsafe anywhere a malicious party could choose the input, such as verifying a security-sensitive download from an untrusted source.
Why does MD5 sometimes feel slower here than the SHA algorithms on very large input?
MD5 in this tool runs as pure interpreted JavaScript, while SHA-1/256/384/512 call the browser's native Web Crypto implementation, which typically runs faster on large inputs than a hand-written JS loop.
Does "Generate All" hash the text five separate times or reuse work?
It runs all five algorithms independently against the same trimmed input text and lists each result on its own line — there's no shared computation between algorithms since they use fundamentally different internal structures.