Which algorithm should I pick?

For a general-purpose modern digest or compatibility checksum, SHA-256 is a common choice. Use MD5 or SHA-1 only when matching a legacy value and not defending against a deliberate forgery. Authentication needs an HMAC or signature, and passwords need a dedicated password-hashing function rather than any option on this page.

Can I get the original text back from a hash?

No — the operation is one-way and discards information, since any input length maps to a fixed output. What is possible is guessing: for short or common inputs an attacker simply hashes candidates until one matches, which is why hashing alone never protects a password or an email address.

Why is MD5 still here if it is broken?

Because it is still published. Plenty of vendors, package mirrors and internal systems list an MD5 checksum, and you need to be able to compute one to check against it. What is broken is collision resistance — an attacker can construct two different inputs with the same digest — which matters for signatures, not for spotting a corrupted download.

How do I identify an algorithm from a digest alone?

By length, since each is fixed. 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256 and 128 is SHA-512. If the string is shorter than expected and contains + or /, it is probably a Base64-encoded digest rather than hex.

Can I use one of these hashes to store passwords?

No. Fast digests such as MD5 and SHA-2 let attackers test guesses too cheaply. Password storage needs a dedicated, salted, configurable password-hashing function such as Argon2id, scrypt, bcrypt, or PBKDF2 with parameters selected for your environment.

Why is the result lowercase hexadecimal?

Hexadecimal is only a readable representation of the digest bytes. Uppercase hex or Base64 can represent the same bytes, but comparisons must use the exact encoding expected by the other system. This page emits lowercase hex and does not offer Base64 output.

MD5, SHA-1, SHA-256 and SHA-512 Generator

Overview

Four text digests, with legacy and password-storage warnings attached

Type UTF-8 text and compute lowercase hexadecimal MD5, SHA-1, SHA-256, and SHA-512 results. The page is useful for reproducible text checks and interoperability, but offers no file reader, key, salt, work factor, authenticity check, or password-hashing construction.

Four simultaneous digests

MD5, SHA-1, SHA-256, and SHA-512 update together from the same text input.

Legacy algorithms labelled

MD5 and SHA-1 are marked for legacy checksum compatibility rather than new security designs.

Web Crypto SHA family

SHA-1, SHA-256, and SHA-512 use crypto.subtle.digest over TextEncoder bytes.

Individual copy controls

Each lowercase hexadecimal digest can be copied independently.

How it works

Using Hash Generator, start to finish

Three steps, in the order the tool above actually takes them.

1
Enter exact text
Whitespace, line endings, normalization, and casing all change the bytes and therefore the digest.
2
Choose the required algorithm
Use the algorithm specified by the interoperating system; prefer a modern construction for new security-sensitive work.
3
Copy and compare
Compare the full digest in a trusted workflow, not only a short prefix displayed in a ticket.

Use cases

What people bring here

The jobs this page is usually opened for, and the setting that makes each one quick.

Reproducing a published text checksum

Hash the exact documented string with its specified algorithm and encoding.

A text digest does not verify a binary download; this page has no file input.

Creating a deterministic cache key

Derive a stable identifier from non-secret normalized text.

Define whitespace, case, Unicode normalization, and line endings before relying on reproducibility.

Demonstrating avalanche behavior

Change one character and compare all four hexadecimal outputs.

A dramatic output change is a hash property, not proof that an unkeyed digest authenticates the source.

Integrity, authenticity, and password storage differ

An unkeyed fast digest cannot prove who supplied the data

A matching digest can detect accidental change when the expected value is trusted. An attacker able to replace both content and checksum defeats that comparison, and fast general hashes are unsuitable for password storage.

Use	Mistaken shortcut	Appropriate construction
Accidental corruption	Any short checksum is enough in an adversarial channel.	Compare the required full digest against an expected value obtained from a trusted source.
Authenticity	SHA-256 alone proves who created the message.	Use a signature or keyed MAC with verified key management.
Passwords	A fast SHA-512 digest is strong password storage.	Use a dedicated password KDF with salt and cost parameters, such as Argon2id, scrypt, or bcrypt where appropriate.
MD5 and SHA-1	Legacy availability makes them suitable for new signatures.	Keep them only for required compatibility checks and never claim collision resistance.

Accidental corruption

Any short checksum is enough in an adversarial channel.

Compare the required full digest against an expected value obtained from a trusted source.

Authenticity

SHA-256 alone proves who created the message.

Use a signature or keyed MAC with verified key management.

Passwords

A fast SHA-512 digest is strong password storage.

Use a dedicated password KDF with salt and cost parameters, such as Argon2id, scrypt, or bcrypt where appropriate.

MD5 and SHA-1

Legacy availability makes them suitable for new signatures.

Keep them only for required compatibility checks and never claim collision resistance.

Privacy

Where your work is processed

The text is hashed locally and never uploaded or saved. Only a deliberate Copy action places a digest on the clipboard.

Source content stays in the tab

Encoding, parsing, formatting, generation, comparison, and cryptographic operations run in browser code. Form values and uploaded text files are not sent to a processing API.

Inputs are not autosaved

Code, tokens, secrets, URLs, and generated outputs stay in component memory until the page reloads or closes. Split-pane tools remember only the divider percentage for the current tab session.

Clipboard and downloads are explicit

The page reads the clipboard only after a Paste action and writes it only after Copy. A local download is created only when you choose the tool's download control.

One aggregate page view may be counted

The page shell can send the tool slug, never the editor contents or filename. The endpoint is rate-limited using a transient requesting address and is skipped for Do Not Track or Global Privacy Control.

More detail in how processing works and our privacy policy.

Limits

Digest inputs and outputs

The values this tool actually enforces, not a rounded-up version.

Algorithms: 4; MD5, SHA-1, SHA-256, and SHA-512.
Input: UTF-8 text; No file upload, stream, or byte editor.
Output: Lowercase hex; Lengths are 32, 40, 64, and 128 characters respectively.
Key / salt / cost: None; No HMAC or password-hashing mode is implemented.

No file hashing, HMAC, password KDF, SHA-3, or BLAKE family

Text input only — there is no file hashing here, so this cannot verify a downloaded archive directly. There is no HMAC (no key input), no salt, no iteration count, and no SHA-3 or BLAKE family. Output is lowercase hex only, not Base64.

FAQ

Hashing and checksum questions

The ones that actually come up.

Developer tools

Choose a neighboring tool for the next step; each page states its processing and limits up front.

Base64 Encoder / DecoderRound-trip UTF-8 text through standard Base64, with invalid input reported clearly.Open URL Encoder / DecoderPercent-encode one URL component with encodeURIComponent, or decode it back.Open JSON FormatterA full JSON workspace for formatting, repair review, queries, conversion, and comparison.Open JSON Repair ProA repair review for malformed and AI-generated JSON, with a named rule behind every change.Open JSON to TypeScriptInfer TypeScript interfaces from one JSON example, with sampling limits stated.Open CSV to JSON ConverterA full data workspace for parsing, mapping, inspecting, cleaning, and converting tabular data.Open

Guides

Reading that goes deeper

Password Best Practices: Length, Passphrases, Managers and 2FAWhy length beats complexity, how passphrases work, and a realistic system for managing passwords without losing your mind.Read