Five algorithms in one place
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 from a single input, so you can compare digests or match whatever a legacy system expects without switching tools.
Hash Generator (MD5 & SHA)
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text.
- Input
- No upload needed — instant
- Privacy
- Nothing is uploaded
- Cost
- Free · no sign-up · no watermark
Loading tool…
The tool is loading its code on your device. This happens once and is cached for later visits.
Processed entirely on your device
Everything you type or paste is handled by JavaScript running in this tab. No request is sent, nothing is logged and nothing is stored. Close the page and it is gone.
Overview
About the Hash Generator (MD5 & SHA)
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text online. Hex and Base64 output, computed in your browser — nothing is uploaded, ever.
A hash function turns input of any size into a fixed-length fingerprint. The same input always produces the same output, a one-bit change produces a completely different digest, and there is no practical route backwards from the digest to the input. Those three properties make hashes useful for checksums, integrity checks, deduplication and digital signatures.
The algorithms offered
MD5 and SHA-1 are still requested constantly for legacy checksums and file-verification systems built around them, so they are included with a warning rather than omitted. For anything new, choose SHA-256 or stronger.
Hexadecimal or Base64
The digest is a sequence of bytes, and how you render it is a choice. Hexadecimal writes each byte as two characters from 0 to 9 and a to f, so a SHA-256 digest is 64 characters long. Base64 packs three bytes into four characters and gives a shorter 44-character string for the same digest. Hex is the convention for checksums and git object identifiers; Base64 appears in URLs, JWTs and APIs where length matters.
Hashing is not encryption
There is no key and nothing to decrypt. A hash is a one-way fingerprint, not a reversible cipher, and this is the most common confusion around the tool. Because a general-purpose hash is built to be fast, hashing a password with it lets an attacker try enormous numbers of guesses per second and simply compare the outputs.
Storing passwords properly
Do not use MD5 or SHA-256 directly for passwords, however strong the algorithm sounds. Password storage needs a slow, salted, memory-hard function designed to resist exactly that brute force — Argon2, bcrypt or scrypt. A fast hash is the wrong tool for credentials. Use this tool for checksums, integrity checks and fingerprints, and a dedicated password hash for anything a user types to log in.
Step by step
How to use the Hash Generator (MD5 & SHA)
Type or paste the text you want to fingerprint into the input panel.
Pick an algorithm — SHA-256 is the safe default, MD5 and SHA-1 are for legacy checksums.
Read the digest instantly in lowercase hex, uppercase hex and Base64.
Copy whichever form you need; nothing was sent to a server.
Why use it
Benefits and common use cases
What this tool is good for, and what it deliberately does not try to do.
Correct UTF-8 hashing
Text is encoded to UTF-8 bytes before hashing, so accents, CJK and emoji produce the same digest as a proper command-line tool rather than a broken byte-per-character hash.
Hex and Base64 side by side
The same digest rendered as lowercase hex, uppercase hex and Base64, covering the conventions used by checksums, git, APIs and JWTs.
Honest about weak algorithms
MD5 and SHA-1 come with a visible warning, because the most common mistake is using a fast general-purpose hash to protect something it cannot protect.
Questions
Frequently asked questions
Short, honest answers about quality, limits and privacy.
Is a hash the same as encryption?
No. Encryption is reversible with a key; hashing is a one-way fingerprint with no key and no route back. A hash proves what the input was, it does not hide it, and it is not a substitute for encryption.
Can I use this to hash passwords?
You can compute the digest, but you should not store passwords this way. MD5, SHA-1 and even SHA-256 are designed to be fast, which lets an attacker try billions of guesses a second. Passwords need a slow, salted, memory-hard function such as Argon2, bcrypt or scrypt.
Why do MD5 and SHA-1 still appear here?
Plenty of existing systems publish MD5 or SHA-1 checksums for downloads, and git still uses SHA-1 for object identifiers. You often need to reproduce or verify a legacy digest even though you would never choose those algorithms for new security work.
What is a collision?
Two different inputs that produce the same digest. For a secure hash this should be impossible to find on purpose. MD5 collisions can be generated in seconds and SHA-1 collisions have been demonstrated, which is exactly why both are considered broken for signatures and certificates.
Why does a one-character change alter the whole hash?
That is the avalanche effect, and it is deliberate. A good hash mixes every input bit into every output bit, so changing one character rewrites roughly half the digest bits. It is what makes a hash useful for detecting even tiny corruption or tampering.