Hash Generator
Paste or type any text and this page shows its MD5, SHA-1, SHA-256 and SHA-512 hashes side by side, updating as you type. Everything is computed in your browser, so the text you enter never leaves the device. A hash is one-way: it can confirm that two pieces of text are identical, but it cannot be turned back into the original.
Hashing is one-way. A hash confirms that two pieces of text are identical; it cannot be turned back into the text it came from. MD5 and SHA-1 should not be used for security — both have practical collision attacks, so keep them for checksums and legacy values and use SHA-256 or SHA-512 for anything that has to resist tampering. Hashing alone is also not how passwords should be stored; that needs a slow, salted algorithm such as bcrypt, scrypt or Argon2. Every byte matters, so a trailing space or newline changes the result completely. Your text is hashed in this browser and is never uploaded.
How to generate a hash from text
- Type or paste your text into the box — all four hashes appear straight away and update as you type.
- Switch the output to uppercase if you need to match how another system prints its hashes.
- Use the copy button beside a hash to copy that one value, or Copy result to take all four together.
When you'd use this
- Comparing two pieces of text — Hash both and see instantly whether they are identical, even when they are far too long to compare by eye.
- Checking a published test vector — Confirm that your own code produces the same digest for a known input, such as the sample values printed in a specification.
- Debugging an API signature — Many APIs sign a request by hashing a string you assemble, so this shows what the digest of that exact string should be.
- Seeing how hashing behaves — Change a single character and every digest changes completely, which makes the avalanche effect easy to demonstrate.
Good to know
- A hash cannot be reversed — Nothing about the original text can be recovered from the digest. Short or common inputs are a different matter: they can be found by looking the hash up in a precomputed table, so a hash is not a way to hide a password or a phone number.
- MD5 and SHA-1 are not for security — Both have practical collision attacks, so they should not be used for signatures, certificates or anything meant to resist tampering. They are still fine for matching legacy values and for spotting accidental corruption, which is why they are here.
- Every byte counts — A trailing space, a newline at the end, or a change of letter case gives a completely different hash. The text is encoded as UTF-8 before hashing, so accented letters, non-Latin scripts and emoji hash the same way they would on a server.
- Hashing is not password storage — Storing passwords needs a slow, salted algorithm such as bcrypt, scrypt or Argon2. A single fast hash of a password can be attacked with a wordlist at enormous speed.
Frequently asked questions
Can a hash be turned back into the original text?
No. Hash functions are one-way by design, and there is no key that reverses them. What can happen is a lookup: if the input was short or common, someone may find it in a precomputed table of hashes, so never treat a hash as a way of hiding secret text.
Should I use MD5 or SHA-1 for security?
No. Researchers have produced real collisions for both, meaning two different inputs with the same hash, so neither is safe for signatures or certificates. Use SHA-256 or SHA-512 instead. MD5 and SHA-1 remain useful for checking legacy values and for detecting accidental corruption.
Why does my hash differ from another tool's?
Almost always because the input is not quite the same. A trailing newline, Windows line endings instead of Unix ones, a stray space, or a different text encoding each produce a completely different digest. This page hashes exactly the characters in the box, encoded as UTF-8.
Can I hash a file here?
No — this page hashes text you type or paste. A file checksum is computed from the file's raw bytes, including anything that is not text, so it is a separate job and pasting a file's contents into the box will not reproduce it.
Is my text sent anywhere?
No. MD5 is implemented in this page's own JavaScript, and SHA-1, SHA-256 and SHA-512 use the Web Crypto support already built into your browser. Nothing is uploaded, and closing the tab clears whatever you typed.