Skip to main content

Hash Generator

English

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes.

All calculations performed locally in your browser. No data sent to server.

Results are for informational purposes. Verify results with other sources.

Hash functions, and what they are for

A hash function turns any input into a fixed-length fingerprint. The same input always gives the same digest; a one-character change gives a completely different one. Hashes verify that data has not changed — they are not a way to store passwords.

How it works

  • MD5 produces 128 bits (32 hex characters), SHA-1 produces 160, SHA-256 produces 256.
  • The output length is fixed regardless of input size: a one-byte file and a one-gigabyte file both yield 64 hex characters under SHA-256.
  • The function is one-way by design. There is no operation that recovers the input from the digest.
  • It is deterministic, so the same file hashed on two machines must produce identical output — which is what makes checksums useful.
MD5      → 128 bits → 32 hex chars   (broken, do not use for security)
SHA-1    → 160 bits → 40 hex chars   (broken, do not use for security)
SHA-256  → 256 bits → 64 hex chars   (current default)

Worked example

Hashing the five-character string hello with each algorithm. You can reproduce these in a terminal.

  1. printf 'hello' | md5
  2. → 5d41402abc4b2a76b9719d911017c592
  3. printf 'hello' | shasum -a 256
  4. → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
  5. now change one letter: printf 'hellp' | shasum -a 256
  6. → a completely unrelated digest, sharing no prefix with the first

One changed character produces an entirely different digest. That avalanche property is what lets a checksum detect a single corrupted byte in a large download.

Reading the result

  • Never hash a password with these. MD5, SHA-1 and SHA-256 are built to be fast, and fast is exactly wrong for passwords — a modern GPU tries billions of SHA-256 guesses per second. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted.
  • MD5 and SHA-1 are broken for security purposes: practical collisions exist, meaning two different inputs can be made to share a digest. They remain fine as non-adversarial checksums for detecting accidental corruption.
  • A hash is not encryption. There is no key and no way back — that is the point, not a limitation.
  • Comparing a hash you computed against one published by the source only proves integrity if the published hash came over a channel an attacker could not also modify.

Common questions

Can I reverse a hash to get the original text?
Not mathematically. What sites advertising this actually do is look your digest up in a precomputed table of common inputs. That works for password and dictionary words, which is precisely why passwords need a salted, slow function instead.
Which algorithm should I use?
SHA-256 for checksums and integrity. bcrypt or Argon2 for passwords. MD5 only when something legacy demands it and nothing about security depends on it.

Sources