Hash Generator

Input Text

Using the hash generator

Type or paste text into the Input Text box.
Press Generate Hashes. The tool shows five results: MD5, SHA-1, SHA-256, SHA-384 and SHA-512. The hashes do not update while you type, so press the button again after every change.
Copy next to each result copies that hash. The button reads Copied! for a moment when it works.

Some things to know before you start:

The tool hashes text only. It has no file upload, so it cannot check a downloaded file. See the commands further down for that.
The browser's built-in crypto library (the Web Crypto API) has no MD5. So this page adds its own small MD5 function. We checked its results against Node.js for empty text, emoji, Hindi and Nepali text, long text and many lengths.
Results are always lowercase hex. There is no Base64 output and no HMAC (a hash with a secret key).
The text is turned into UTF-8 bytes first. The SHA hashes then come from your browser's crypto.subtle.digest(). Browsers only allow this on secure pages (HTTPS or localhost). If you open the page from a plain http:// address, the tool shows a message and gives only the MD5 hash.

A worked example

These are the results for the word hello, checked against Node.js and the md5 and shasum commands:

Algorithm	Hex length	Hash of `hello`
MD5	32	`5d41402abc4b2a76b9719d911017c592`
SHA-1	40	`aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d`
SHA-256	64	`2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824`
SHA-384	96	`59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f`
SHA-512	128	`9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043`

Change one letter and the whole hash changes. The SHA-256 of Hello with a capital H is 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969. There is no pattern that links the two.

Other languages work too. The SHA-256 of नमस्ते is ddb08d77c2d511947652161b35987022711aa216387b041dd459a03eb66a8304, the same result Node.js gives for that text in UTF-8.

If the box is empty, you still get a result. The SHA-256 of nothing is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, and the MD5 of nothing is d41d8cd98f00b204e9800998ecf8427e. If you see a hash that starts with e3b0c442 or d41d8cd9, you hashed an empty input.

Why your hash does not match another tool

A hash changes if even one byte of the input changes. These are the usual hidden differences:

A newline at the end. echo hello | shasum -a 256 gives 5891b5b5..., not 2cf24dba..., because echo adds a newline. Use printf '%s' hello | shasum -a 256 to match this tool. In the same way, if you press Enter after your text in the box, the newline is part of the input.
Spaces. The tool does not trim the text. A space before or after the text gives a different hash.
Windows line breaks. A browser text box turns Windows line breaks (CR LF) into a single LF. So multi-line text from a Windows file may hash differently here than the file itself.
Letters that look the same. café can be stored as 4 characters (é as one character) or as 5 (e plus an accent mark). They look the same but hash differently: 850f7dc4... and 81ef060b... for SHA-256.
A different text encoding. This tool uses UTF-8. A program that hashes UTF-16 or Latin-1 bytes gets a different result for any non-English text.
Upper-case hex. 2CF24DBA... and 2cf24dba... are the same hash. Compare them without caring about case.

Which algorithm should you use?

SHA-256 is the normal choice today. Most checksums, APIs and file downloads use it.
SHA-384 and SHA-512 give longer hashes. Use them when a system or a standard asks for them. For most everyday checks, SHA-256 is enough.
SHA-1 is broken for security. In 2017, researchers published two different PDF files with the same SHA-1 hash. Use it only when an old system needs it, never for signatures or certificates.
MD5 is broken for security. It is even weaker than SHA-1. Anyone can make two different inputs with the same MD5 hash on a normal computer. It is still fine for jobs where nobody is attacking you: matching an old MD5 checksum, finding duplicate files, or making a cache key. Never use it for passwords, signatures or certificates. To check this tool on the command line, printf '%s' hello | md5 on a Mac or printf '%s' hello | md5sum on Linux both give 5d41402abc4b2a76b9719d911017c592, the same as here.

Checking a downloaded file

Because this tool only reads text, use your computer's built-in command to hash a file. Then compare the result with the hash on the download page:

Mac:      shasum -a 256 file.zip
Linux:    sha256sum file.zip
Windows:  certutil -hashfile file.zip SHA256

If the download page only lists an MD5 checksum, use md5 file.zip on a Mac, md5sum file.zip on Linux, or certutil -hashfile file.zip MD5 on Windows.

A hash is not encryption, and not a password store

You cannot decrypt a hash. There is no key, and the original text is not inside it. But short or common inputs can be found by guessing. The SHA-256 of password is 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8. Searching that hash online finds the word at once. The MD5 of password, 5f4dcc3b5aa765d61d8327deb882cf99, is even better known. So a hash does not hide a short secret.

Do not store passwords with plain MD5, SHA-256 or SHA-512. These functions are designed to be fast. A single graphics card can test billions of guesses per second against them. Password storage needs a slow hash with a random salt for each user, such as Argon2id, bcrypt or scrypt. Most programming languages have a trusted library for them.

A hash does not prove who sent something. Anyone can compute the SHA-256 of a message. To prove that data came from you and was not changed, use an HMAC with a secret key or a digital signature.

Frequently Asked Questions

Is MD5 safe to use?

Not for security. People can make two different inputs with the same MD5 hash on a normal computer. MD5 is fine for matching an old checksum, finding duplicate files or making cache keys. For anything about security, use SHA-256.

Why do I only see the MD5 hash?

The SHA hashes use the Web Crypto API. Browsers only allow it on secure pages (HTTPS or localhost). If the page is opened from a plain http address, the tool shows a message and gives only MD5. Open it with https to get all five hashes.

Why does my hash not match the one from the command line?

Usually the command added a newline. echo hello | shasum -a 256 hashes hello plus a newline. Use printf with %s instead of echo to hash the text alone. Extra spaces, Windows line breaks and different Unicode forms of the same letter also change the hash.

Can I use MD5 or SHA-256 to store user passwords?

No. MD5 and SHA-256 are fast, so attackers can test billions of guesses per second. Store passwords with a slow, salted password hash such as Argon2id, bcrypt or scrypt, using a trusted library for your language.

Can a hash be reversed to get the original text?

Not directly. A hash has no key and does not contain the text. But short or common inputs can be guessed. The SHA-256 of the word password is in many public lookup lists, so searching for the hash reveals the word.

Can I hash a file with this tool?

No. It only hashes the text in the box. To check a download, use shasum -a 256 on a Mac, sha256sum on Linux, or certutil -hashfile with SHA256 on Windows, and compare the result with the published hash.

Is my text sent to a server?

No. The MD5 hash is made by code inside this page. The SHA hashes are made by crypto.subtle.digest in your browser. The page does not send your text anywhere.