Hash generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hash values from any text in your browser. Nothing is sent to a server — all hashing uses the Web Crypto API.
What is a hash?
A cryptographic hash function converts any input into a fixed-length string of characters. The same input always produces the same hash, but even a tiny change in input produces a completely different hash — this is called the avalanche effect. Hashes are one-way: you can't reverse a hash to get the original input.
Common uses include password storage (store the hash, not the password), file integrity verification (compare checksums after download), digital signatures, and data deduplication. SHA-256 is the most widely used today; MD5 and SHA-1 are considered insecure for cryptographic purposes but still useful for checksums.
When to use each algorithm
MD5 (128-bit): Fast, widely supported. Collisions have been demonstrated, so it's insecure for cryptographic purposes. Still fine for non-security checksums, hash tables, and cache keys.
SHA-1 (160-bit): Deprecated for security purposes after collision attacks were demonstrated in 2017. Still appears in legacy systems and git commit hashes (git is transitioning to SHA-256).
SHA-256 (256-bit): The current workhorse. Used in TLS/SSL, Bitcoin, certificate signatures, and most modern cryptographic protocols. Recommended for almost any new use case.
SHA-512 (512-bit): Longer output with a slightly stronger security margin. Used when a longer hash is required or for extra conservatism.
Hashing vs encryption
Hashing is one-way — you can't recover the original data from the hash, only verify that a candidate input matches. Encryption is two-way — you can decrypt with the right key. Hashing is for verification (password checks, file integrity). Encryption is for confidentiality (protecting data in transit or at rest).
Need to generate unique identifiers instead? Try our UUID generator.
MD5 vs SHA-1 vs SHA-256 vs SHA-512: Algorithm Comparison
Choose the right hash algorithm for your use case — security requirements, output size, and performance differ significantly.
| Feature | MD5 | SHA-1 | SHA-256 Recommended | SHA-512 |
|---|---|---|---|---|
| Output length (bits) | 128 | 160 | 256 | 512 |
| Output (hex chars) | 32 | 40 | 64 | 128 |
| Speed (relative) | Fastest | Fast | Moderate | Slower |
| Security status | Broken — collisions known | Deprecated | Secure | Secure |
| Common use case | Checksums only | Legacy systems | TLS, code signing | High-security apps |
| NIST recommended | No | No | Yes | Yes |
MD5 and SHA-1 are cryptographically broken for security purposes. Use SHA-256 or SHA-512 for any new implementation.
Common Uses
- File integrity verification: Generate a SHA-256 hash of a file before and after transfer to confirm no corruption or tampering occurred.
- Password storage prototyping: Prototype how passwords should be hashed (SHA-256, SHA-512) before implementing server-side storage in a web application.
- API signature generation: Many APIs require HMAC-SHA256 signatures for request authentication — use the hash tool to test signature construction.
- Blockchain learning: Understand how Bitcoin's proof-of-work functions by hashing block headers and observing how changing a single byte alters the output.
- Deduplication keys: Generate content hashes to detect duplicate files or database records without storing or comparing the full content.
- Data anonymisation: Hash personally identifiable information (email, phone) for analytics use cases where the original value must not be stored.
- Git commit understanding: Git uses SHA-1/SHA-256 to identify commits — hash a string to understand how Git assigns unique identifiers to objects.
FAQ
Is MD5 still safe to use?
Not for security — don't use it for passwords, digital signatures, or anything where an attacker could benefit from finding a collision. It's still fine for non-cryptographic uses like checksums, cache keys, or deduplication, where speed matters more than collision resistance.
Can I reverse a hash to get the original text?
No. Hashes are one-way by design — the hashing process is not an invertible function. Dictionary attacks and rainbow tables can find common inputs (a reason to salt password hashes), but the hash itself cannot be reversed.
Why do different algorithms produce different length hashes?
Each algorithm has a fixed output size. MD5 produces 32 hex characters (128 bits), SHA-1 produces 40 (160 bits), SHA-256 produces 64 (256 bits), and SHA-512 produces 128 (512 bits). Longer hashes have a larger output space and more resistance to collisions.
Does the hash generator send my text to a server?
No. All hashing is performed client-side using the Web Crypto API built into your browser. Your text never leaves your device.
Can I reverse a hash back to the original text?
No. Cryptographic hash functions are one-way — it is computationally infeasible to reconstruct the original text from a hash. This is by design and is what makes hashes useful for security.
By the Numbers
- SHA-256 produces a 256-bit (32-byte) output — 2^256 possible values, more than atoms in the observable universe
- MD5 was cryptographically broken in 2004 via collision attacks (Wang & Yu); NIST deprecated it for all security use
- NIST standardized SHA-3 (Keccak) in 2015 as a structural backup to SHA-2 using a different sponge construction
- Bitcoin's blockchain relies on SHA-256 — finding a valid block hash requires ~10^21 hash operations per second network-wide