Hash Generator
Create MD5, SHA-1, SHA-256, and SHA-512 UTF-8 digests locally.
Byte count appears after generation
Digests
MD5 Not secure — collision-vulnerable
Waiting for input
SHA-1 Not secure — collision-vulnerable
Waiting for input
SHA-256
Waiting for input
SHA-512
Waiting for input
Working notes
Use Hash Generator with the boundary visible.
Hash Generator calculates deterministic MD5, SHA-1, SHA-256, or SHA-512 digests from the exact UTF-8 bytes entered in the browser.
What is Hash Generator?
A cryptographic hash function takes an input of any size and produces a fixed-length output (the digest or hash) that is deterministic, fast to compute, and practically impossible to reverse. The same input always produces the same hash, but even a single-bit change produces a completely different output (the avalanche effect). Hashes are fundamental to software engineering: Git uses SHA-1 (migrating to SHA-256) to identify every commit, tree, and blob; package managers verify downloads with SHA-256 checksums; CI/CD pipelines use content hashes to skip unchanged build steps; and HMAC-based authentication signs API requests with a shared secret. MD5 (128-bit) and SHA-1 (160-bit) are provided for compatibility with legacy systems but are no longer collision-resistant — meaning two different inputs can produce the same hash. SHA-256 (256-bit) and SHA-512 (512-bit) from the SHA-2 family remain secure for all integrity and authentication use cases. This tool uses the browser's built-in SubtleCrypto API (the same implementation used for TLS) so your input text never leaves your device.
When to use it
- Verifying file integrity — compute the SHA-256 hash of a downloaded binary and compare it to the publisher's checksum to detect corruption or tampering.
- Debugging Git objects — hash a file's content to confirm the blob SHA that Git stores, or verify that a commit hash matches expected content.
- Comparing API payloads — hash the request body before and after serialization to confirm that encoding did not alter the content.
- Generating cache keys — hash configuration or input data to create deterministic cache keys for build systems, CDN purge rules, or memoization.
- Checking password breach databases — hash a password with SHA-1 and check the first 5 characters against the Have I Been Pwned k-anonymity API without exposing the full hash.
How to use it
- 01Enter the text whose exact UTF-8 digest you need.
- 02Choose one or more hash algorithms: MD5, SHA-1, SHA-256, or SHA-512.
- 03Generate the hash. The hexadecimal digest is displayed instantly.
- 04Compare the result with a value from a trusted channel — matching hashes confirm identical input.
Common mistakes
- Using plain hashes for password storage — a fast hash like SHA-256 can be brute-forced at billions of attempts per second. Use bcrypt, scrypt, or Argon2 for password storage.
- Relying on MD5 or SHA-1 for security — both algorithms have known collision attacks. Use them only for non-security checksums (legacy compatibility, content addressing).
- Hashing different encodings — UTF-8, UTF-16, and Latin-1 encode the same text as different bytes, producing different hashes. Ensure both parties use the same encoding.
- Confusing hashing with encryption — hashing is one-way (you cannot recover the input from the hash). Encryption is two-way (you can decrypt with the key).
- Ignoring trailing whitespace — a space or newline at the end of the input changes the hash. Trim input consistently when comparing hashes across systems.
Synthetic example
Hash a public sample
Input
stackcache
Result
SHA-256: deterministic 64-character hexadecimal digest
Hash algorithm comparison
| Feature | MD5 | SHA-1 | SHA-256 | SHA-512 |
|---|---|---|---|---|
| Output size | 128 bits (32 hex) | 160 bits (40 hex) | 256 bits (64 hex) | 512 bits (128 hex) |
| Collision-resistant | No | No | Yes | Yes |
| Speed | Fastest | Fast | Fast | Slightly slower |
| Use in Git | No | Yes (legacy) | Yes (new default) | No |
| Recommended for | Checksums only | Legacy compat | General purpose | Extra security margin |
Related standards
Limits and data boundary
- MD5 and SHA-1 are retained for compatibility checks, not collision-resistant security.
- A plain hash is not a password-storage scheme; use a purpose-built password KDF.
Frequently asked questions
- Which hash algorithms are supported?
- MD5, SHA-1, SHA-256, and SHA-512. SHA-256 and SHA-512 are recommended for integrity checks; MD5 and SHA-1 are provided for compatibility only.
- Is my input sent to a server?
- No. Hashing uses the browser's built-in SubtleCrypto API and runs entirely on your device. Your text is never uploaded.
- Can I use this tool to hash passwords?
- Plain hashing is not suitable for password storage. Use a dedicated key derivation function like bcrypt, scrypt, or Argon2 for storing passwords securely.
- Why do MD5 and SHA-1 produce different length outputs?
- Each algorithm has a fixed output size: MD5 produces 128 bits (32 hex characters), SHA-1 produces 160 bits (40 hex characters), SHA-256 produces 256 bits (64 hex), and SHA-512 produces 512 bits (128 hex).
- What is the avalanche effect?
- The avalanche effect means that changing even one bit of the input produces a completely different hash output. This property makes hashes useful for detecting any modification to data.
Keep working