Hash Generator
Generate MD5 and SHA hashes at once - free, no signup.
MD5 and SHA-1 are broken for security purposes (collisions are practical to produce) - they're offered here for checksums and legacy compatibility, not for hashing passwords or anything security-sensitive. Use SHA-256 or SHA-512 for that.
What this tool does
Type your text and see its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes all at once, updating as you type. SHA-256 and above come from the browser's native, standards-compliant Web Crypto API. MD5 is deliberately excluded from that API because it's cryptographically broken, so this tool implements it directly, verified against the official RFC 1321 test vectors - offered for checksums and legacy compatibility, not for anything security-sensitive.
Computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of your text simultaneously.
Uses the browser's native Web Crypto API for the SHA family, and a hand-verified implementation of MD5 (which Web Crypto omits entirely).
Updates every hash live as you type or edit the text, so you can see immediately how a single-character change produces a completely different hash - the avalanche effect a good hash function is supposed to have.
Encodes text as UTF-8 before hashing, so accented letters and non-Latin scripts produce the same hash any standard UTF-8-based hashing tool would produce for the same text.
Offers a single 'copy all hashes' button that copies every algorithm's output as labelled lines, not just one value at a time.
How to use it
- Type or paste your text.
- Read off whichever hash your task needs.
- Copy the one you need with its own copy button.
Why use this generator
Hashes verify that data is unchanged and identify content, and different systems expect MD5 or a SHA family value. Producing all at once avoids repeated runs.
Why we built it
We built the hash generator to compute MD5 and the SHA family at once from one input, instead of needing five separate tools. Hash files with the file hash generator and generate IDs with the UUID generator.
For a neighbouring job there is also the HTML Entity Encoder/Decoder.
Who this tool is for
- Developers verifying files and strings
- Security learners
- Admins comparing checksums
When to use it
- Checking text against a known hash.
- Creating content fingerprints.
- Learning how hashing differs by algorithm.
- Comparing hash output between systems.
Which hash should you actually use
Not all of these are safe for the same purposes.
MD5 and SHA-1 are both cryptographically broken: practical attacks exist to produce two different inputs with the same hash (a 'collision'), which defeats the purpose of using a hash to detect tampering or verify authenticity. They're included here because they're still widely used for non-security purposes - checking a downloaded file hasn't been corrupted, or matching against a legacy system that already uses them - not because they're recommended for anything new.
SHA-256 and SHA-512 have no known practical collision attacks and are the standard choice for anything security-relevant: verifying file integrity where tampering is a real concern, or as a building block in other cryptographic systems. If you're not sure which to use and security matters at all, use SHA-256.
Where each hash actually comes from
Two different implementations sit behind the five outputs, for a specific reason.
SHA-1, SHA-256, SHA-384 and SHA-512 are all computed with the browser's own crypto.subtle.digest() function, part of the standard Web Crypto API - the same, audited implementation every native app and server on that platform relies on, not a JavaScript re-implementation. MD5 has no crypto.subtle equivalent at all, because the Web Crypto specification deliberately left it out as a broken algorithm not worth standardising. To offer MD5 anyway, this tool includes a small hand-written implementation that follows RFC 1321 directly and is checked against the RFC's own published test vectors, so its output can be trusted to match any other correct MD5 implementation even though it isn't running through the browser's native crypto layer.
| Algorithm | Output length | Source | Status |
|---|---|---|---|
| MD5 | 128 bits (32 hex chars) | Hand-written, RFC 1321 | Broken - collisions practical |
| SHA-1 | 160 bits (40 hex chars) | Web Crypto (native) | Broken - collisions practical |
| SHA-256 | 256 bits (64 hex chars) | Web Crypto (native) | Safe, current standard |
| SHA-384 | 384 bits (96 hex chars) | Web Crypto (native) | Safe |
| SHA-512 | 512 bits (128 hex chars) | Web Crypto (native) | Safe |
What you give it, and what you get back
| Item | Details |
|---|---|
| Input | Text. |
| Output | MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once. |
| Notes | MD5 and SHA-1 are not for security. |
Issues you may run into
| What you see | Why it happens | What to do |
|---|---|---|
| Hash does not match | A trailing space, newline or encoding difference. | Check exact input bytes. |
| A file hash is needed | This hashes text. | Use the file hash generator. |
| Passwords | Fast hashes are unsuitable for passwords. | Use a password hashing function. |
Assumptions and limitations
- This hashes text as typed - hashing a file's actual contents would need a tool built for file input, not a text box.
- MD5 and SHA-1 are shown for compatibility and non-security use only; this tool does not pretend they're safe for anything where collision resistance matters.
Frequently asked questions
How do I generate a hash online for free?
Type your text and every hash (MD5, SHA-1, SHA-256, SHA-384, SHA-512) appears instantly, updating live. No signup, no upload.
Which hash algorithm should I use?
SHA-256 for anything where security matters - it has no known practical collision attacks. MD5 and SHA-1 are offered for legacy compatibility and simple checksums only, since both are cryptographically broken.
Why isn't MD5 available through the browser's built-in crypto API?
The Web Crypto standard deliberately excludes MD5 because it's a broken algorithm. This tool implements MD5 directly instead, verified against the official RFC 1321 test vectors, purely for the legacy and checksum use cases people still need it for.
Can I hash a file instead of text?
Not with this tool - it works on text you type or paste. Hashing a file's contents needs a tool built to read file input.
Is my text uploaded anywhere?
No. All hashing happens entirely in your browser - nothing is sent to a server, and closing the tab clears it.
Why do SHA-1 and SHA-256 come from different code than MD5?
SHA-1 through SHA-512 all run through the browser's native Web Crypto API (crypto.subtle.digest), which is standard on every modern browser. MD5 was deliberately left out of that API because it's broken, so this tool has to compute it itself with a hand-written implementation checked against the official RFC 1321 test vectors.
Will the same text always produce the same hash here as in another tool?
Yes, for a given algorithm - MD5 and SHA-1/256/384/512 are fully standardised, so any correct implementation (this tool, a command-line utility, another website) produces byte-for-byte the same hash for the same input text encoded the same way (UTF-8).