Hash Generator
Paste any text and get its SHA-256, SHA-512, MD5, or SHA-1 hash instantly. The Web Crypto API handles everything locally, your input never leaves the browser.
Generate cryptographic hashes of your text using various algorithms including SHA-256, SHA-512, and more. All processing happens locally in your browser - no data is sent to any server.
How to generate a hash
Paste text, pick MD5 or a SHA algorithm, and copy the hex digest.
- 01
Paste the text to hash
Any text works: a string from your code, a line of JSON, a message to fingerprint. It's converted to UTF-8 bytes first, so accents and emoji hash the same way they would in most programming languages.
- 02
Pick the algorithm
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are available, with SHA-256 selected to start. Use the one the system you're matching expects.
- 03
Generate and copy the hex digest
Press Generate Hash and the digest appears as lowercase hexadecimal, hidden at first. The eye icon shows it, which keeps sensitive hashes off a shared screen until you want them.
The five algorithms compared
Every row below is the hash of the word hello, cut short. The same input always gives the same output, and changing a single letter gives a completely different one: Hello with a capital H has a SHA-256 hash starting 185f8db3, nothing like the lowercase version.
| Algorithm | Size | Hex characters | hash of "hello" | Use it for |
|---|---|---|---|---|
| MD5 | 128 bits | 32 | 5d41402abc4b2a76… | Broken for security; fine for non-adversarial checksums |
| SHA-1 | 160 bits | 40 | aaf4c61ddcc5e8a2… | Broken since 2017's SHAttered collision; legacy use only |
| SHA-256 | 256 bits | 64 | 2cf24dba5fb0a30e… | The everyday default: checksums, signatures, Git's newer format |
| SHA-384 | 384 bits | 96 | 59e1748777448c69… | Used in TLS certificates and Subresource Integrity |
| SHA-512 | 512 bits | 128 | 9b71d224bd62f378… | Often faster than SHA-256 on 64-bit CPUs |
SHA-1, SHA-256, SHA-384 and SHA-512 are computed with the browser's Web Crypto API. Browsers don't offer MD5 there, so the tool includes its own MD5 implementation, checked against the standard test values.
Hashing is not encryption, and not password storage
A hash is one-way: there's no key and no way to turn the digest back into the text. That's what makes it useful for checking a file wasn't changed, or for comparing two values without revealing them. It's not a way to hide data you need to read again; for that you need encryption.
Plain hashes are also the wrong tool for storing passwords. SHA-256 is designed to be fast, so an attacker with a leaked database can try billions of guesses a second on a graphics card. Password storage needs a deliberately slow function with a salt, such as Argon2id, bcrypt or scrypt, which your web framework almost certainly provides.
What hashes are used for
Checking a download against its checksum
Download pages often list a SHA-256 value. For a text file you can paste its contents here; for binaries, use sha256sum or Get-FileHash in a terminal, since this tool hashes text only.
Making a stable ID from content
Hashing a normalised URL or a JSON string gives the same short ID every time, which is useful for cache keys and de-duplication.
Matching a value another system produced
When an API or webhook sends a hash of a payload, hash the same text here to check your understanding of the exact input it used.
Why your hash doesn't match
- A trailing newline is the usual culprit. echo "hello" | sha256sum in a terminal hashes hello plus a newline; use echo -n to match this tool.
- Different text encodings give different bytes. This tool uses UTF-8; older systems sometimes hash Latin-1 or UTF-16.
- Case matters in the input, not the output. Hex digests are the same value in upper or lower case, but Hello and hello are different inputs.
- HMAC isn't plain hashing. Webhook signatures are usually HMAC-SHA256 with a secret key, which this tool doesn't compute.