Generate MD5 and SHA hashes
Type or paste text and see all five digests side by side. SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser Web Crypto API; MD5 is computed locally because browsers deliberately no longer provide it. Input is treated as UTF-8 bytes, so results match what a server would compute for the same string.
How to use the Hash Generator
- Paste the text you want to hash.
- All five digests are computed as you type.
- Choose hexadecimal or Base64 output to match the system you are comparing against.
- Copy a digest, or download every result as a text file.
What a hash is for
A cryptographic hash turns any input into a fixed-length fingerprint. The same input always gives the same digest, a one-character change gives a completely different one, and the function cannot be run backwards. That makes hashes useful for verifying that a download or a copied file is intact, for detecting whether a record has changed, for building cache keys and ETags, and as a building block inside signatures and HMACs.
| Algorithm | Digest | Status | Use it for |
|---|---|---|---|
| MD5 | 128 bits, 32 hex | Broken since 2004 — collisions are trivial | Legacy checksums only |
| SHA-1 | 160 bits, 40 hex | Broken in 2017 (SHAttered) | Git object IDs and other legacy formats |
| SHA-256 | 256 bits, 64 hex | Recommended default | Integrity, signatures, TLS, blockchains |
| SHA-384 | 384 bits, 96 hex | Strong | Suite B / high-assurance profiles |
| SHA-512 | 512 bits, 128 hex | Strong, faster than SHA-256 on 64-bit CPUs | Large files, HMAC-SHA-512 |
Why MD5 and SHA-1 are still here
Both are cryptographically broken: researchers can construct two different files with the same MD5 in seconds, and Google produced a SHA-1 collision in 2017. Neither should be used where an attacker could benefit from forging a match — signatures, certificates, deduplication of untrusted uploads. They remain useful for checking that a file survived a copy, because accidental corruption will still change the digest, and countless tools and package registries still publish MD5 sums.
Never hash a password this way
A plain hash is the wrong tool for passwords. Modern hardware computes billions of SHA-256 digests per second, so a leaked table of hashed passwords is cracked quickly regardless of the algorithm. Passwords need a slow, salted, memory-hard function: Argon2id first, then scrypt or bcrypt. Adding a salt to SHA-256 helps only against rainbow tables, not against brute force.
Matching another tool's output
If a digest here differs from one produced elsewhere, the cause is almost always the input bytes rather than the algorithm. Check for a trailing newline (the shell command echo hello adds one; echo -n hello does not), for CRLF versus LF line endings in pasted text, and for a byte-order mark at the start of a file. The empty string hashes to d41d8cd98f00b204e9800998ecf8427e in MD5 and e3b0c442…b855 in SHA-256, which is a quick way to confirm two tools agree.
Files
This page hashes text. To verify a downloaded file, use your operating system: sha256sum file on Linux, shasum -a 256 file on macOS, or Get-FileHash file in PowerShell.
Frequently asked questions
Can I reverse a hash to get the original text?
No. Hashes are one-way. Short or common inputs can be found by looking them up in a precomputed table, which is exactly why passwords need salting and a slow algorithm.
Is MD5 safe to use?
Only for detecting accidental corruption. Deliberate collisions are easy to construct, so never use MD5 where forgery would matter.
Why does my digest differ from the command line?
Usually a trailing newline added by echo, or CRLF line endings. Compare the byte counts first.
Is my text uploaded to hash it?
No. SHA digests use the browser Web Crypto API and MD5 runs in a local script; nothing leaves the page.
Privacy
This tool runs entirely inside your browser using WebAssembly and the Canvas/File APIs. Your files are never uploaded to ToolFlint or any third party; you can verify this in your browser's network tab or by switching to airplane mode after the page loads. Read how we process files.
Last updated 2026-09-23.