Hash Generator Online — MD5, SHA-1, SHA-256 & SHA-512, Free

By Alex Johnson. I reach for a hash generator several times a week, usually for something small: checking a SHA-256 value against a config file, making a cache key, writing a test that expects a known digest. The text I paste in is sometimes an API token. Sending that to a stranger's server just to get a hash back always seemed backwards to me, so this generator does all of its work inside your browser tab.

Type or paste into the box above and four digests appear as you type: MD5, SHA-1, SHA-256 and SHA-512. Each has its own Copy button. If the value you're comparing against is printed in capital letters, tick UPPERCASE and all four switch over.

What a hash is

A hash function takes input of any length and returns a fixed-length string called a digest. Give SHA-256 one word or an entire novel and it hands back exactly 64 hexadecimal characters.

The same input produces the same digest every time, on every machine, which is why two people can compare a short hash instead of comparing whole files. Change a single character and the digest changes completely. Here are the SHA-256 hashes of two words that differ only in their first letter:

hello  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Hello  185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

Nothing in the second digest hints that the inputs were almost identical. Cryptographers call this the avalanche effect.

Hashing only goes one way. You can't run the function backwards to get the text out of a digest, and that is the main difference from encryption, which is built to be reversed by whoever holds the key.

MD5, SHA-1, SHA-256 and SHA-512 compared

• MD5: 128 bits, shown as 32 hex characters. Published in 1992 as RFC 1321.
• SHA-1: 160 bits, 40 characters. Published in 1995.
• SHA-256: 256 bits, 64 characters. Part of the SHA-2 family, published in 2001.
• SHA-512: 512 bits, 128 characters. Also SHA-2.

MD5 and SHA-1 were retired from security work because researchers learned to build collisions on purpose: two different inputs that share one digest. Xiaoyun Wang's team demonstrated practical MD5 collisions in 2004. In 2017, Google and CWI Amsterdam published two different PDF files with the same SHA-1 hash, a project they called SHAttered.

Random corruption won't produce a collision, so MD5 is still fine for spotting a damaged copy, deduplicating files or building cache keys. Anywhere an attacker could craft the input, such as signatures, certificates or integrity checks on files you didn't create yourself, use SHA-256 or SHA-512. That is why the tool shows a warning under the MD5 and SHA-1 fields.

How to use the hash generator

1. Click into the Input text box in the tool at the top of this page and type or paste your text.
2. Watch the four fields fill in. They update on every keystroke, so there is no button to press.
3. Tick UPPERCASE if the hash you're matching uses capital letters. PowerShell's Get-FileHash, for one, prints uppercase.
4. Press Copy next to the algorithm you need.
5. Press Clear to empty the input and all four outputs.

With an empty input the fields stay blank. The tool doesn't show the hash of zero bytes, which for SHA-256 is e3b0c442…7852b855. If that value ever turns up in your logs or database, some code hashed an empty string by mistake.

Why your hash doesn't match

When a hash from this page disagrees with one from somewhere else, the algorithm is almost never the problem. The inputs differ in a way you can't see.

The most common culprit is a trailing newline. On the command line, echo "hello" | sha256sum hashes "hello" plus a line break and gives 5891b5b5…, while this tool gives 2cf24dba… for the bare word. Use printf '%s' "hello" | sha256sum or echo -n to hash the text alone.

Line endings cause the next most trouble. Browsers store line breaks in a text box as a single newline character, but files saved on Windows often use a carriage return plus a newline, so multi-line text hashed here won't match the same file hashed on disk. Stray spaces picked up when you copied a value do the same thing.

Then there is encoding. This tool hashes the UTF-8 bytes of your text. Code that hashes UTF-16, which is what .NET's Encoding.Unicode produces, gets a different answer for the same characters. Even within UTF-8, "café" can be stored as 5 bytes or 6 depending on whether the é is one character or an e followed by a combining accent, and the two forms hash differently even though they look identical on screen.

Git is a special case. Its object IDs are SHA-1 hashes, but Git adds a short header to the content before hashing, so pasting a file's text here won't reproduce the ID that git hash-object prints.

Hashing text vs hashing files

This generator hashes text you type or paste. It doesn't take file uploads. To check a downloaded installer or disk image against the checksum on its download page, use the command your operating system already has:

macOS     shasum -a 256 filename
Linux     sha256sum filename
Windows   Get-FileHash filename    (PowerShell, SHA-256 by default)

Don't store passwords with a plain hash

SHA-256 was designed to be fast, and one modern graphics card can compute billions of SHA-256 hashes per second. For passwords that speed is a liability. Someone who steals a table of SHA-256 password hashes can test guesses at the same rate, and common passwords fall immediately. The MD5 of "password" is 5f4dcc3b5aa765d61d8327deb882cf99, and pasting that string into a search engine turns up the answer straight away.

Password storage needs a deliberately slow, salted algorithm such as Argon2, bcrypt or scrypt, and every mainstream web framework ships one. Use this generator for checksums, cache keys, test fixtures and comparing values.

What happens to the text you paste

The three SHA hashes come from the Web Crypto API (crypto.subtle.digest), which every current browser includes. Web Crypto doesn't offer MD5, so the page carries a small MD5 implementation written from the RFC 1321 specification. Neither one sends anything over the network. You can confirm it yourself: open your browser's developer tools, switch to the Network tab and type in the box. No requests appear, and once the page has loaded it keeps working with your Wi-Fi switched off.

Frequently asked questions

How do I generate an MD5 or SHA-256 hash online?

Type or paste your text into the generator at the top of this page. MD5, SHA-1, SHA-256 and SHA-512 hashes appear as you type, each with its own copy button. It runs in your browser with no signup, and nothing is uploaded.

What is a hash?

A hash is a fixed-length fingerprint computed from any input. The same input always gives the same hash and a one-character change gives a completely different one. The original text can't be recovered from the hash, which makes hashes useful for checking that data hasn't changed.

Which hash algorithm should I use?

Use SHA-256 for almost everything, or SHA-512 when a system asks for it. Keep MD5 and SHA-1 for checksums, cache keys and older systems that require them, since both have known collision attacks.

Is it safe to hash sensitive text online?

With this tool, yes. Every hash is computed locally in your browser, so the text never leaves your device. Many other hash sites send your input to a server, so check how a tool works before pasting tokens or private data into it.

Why doesn't my hash match the one I expected?

Usually the inputs differ in a way you can't see: a trailing newline (common when using echo on the command line), Windows line endings, extra spaces, or a different text encoding. Uppercase and lowercase hex also break a plain text comparison even when the digests are the same.