Hash Generator

A cryptographic hash function turns input of any length into a fixed-size digest. Change one bit of the input and roughly half the bits of the digest flip, and there is no practical way to run the function backwards. Those two properties are why hashes sit underneath file checksums, Git object IDs, TLS certificates, JSON Web Token signatures and every password database that is doing things correctly.

This page computes MD5, SHA-1, SHA-256 and SHA-512 for any text you type, using the crypto-js library inside your browser. The text is encoded as UTF-8 first, so non-Latin characters such as the rupee sign hash exactly as they would in Node.js, Python or OpenSSL. Digests are shown as lowercase hexadecimal and update on every keystroke. Nothing is sent to a server.

The four algorithms at a glance

"Broken" has a precise meaning here. A collision attack lets someone craft two different inputs with the same digest. That ruins MD5 and SHA-1 for signatures and certificates, where an attacker controls the input. It does not let anyone reverse a digest, or find a second input for an arbitrary existing hash (a preimage), which is why an MD5 checksum on an internal download mirror is sloppy rather than instantly exploitable. Treat both as legacy and pick SHA-256 for anything new.

Hashing is not encryption, and plain hashing is not password storage

Encryption is reversible by whoever holds the key. A hash has no key and no reverse. That makes hashes the wrong tool for anything you need to read back, and the right tool for integrity checks. Passwords are a special case. A fast hash like SHA-256 can be computed billions of times per second on a GPU, so an attacker who steals a table of unsalted SHA-256 password hashes simply tries common passwords until the digests match.

Why the same text can hash differently somewhere else

The most common question about hashes is "your tool gives a different SHA-256 than my terminal". The digest is almost always right on both sides; the bytes going in differ. Things that silently change the input:

• A trailing newline. echo hello | sha256sum hashes six bytes because echo appends a line feed. Use printf '%s' hello or echo -n. On this page SHA-256 of hello begins 2cf24dba, while hello followed by a newline begins 5891b5b5.
• Text encoding. This page and most Unix tools use UTF-8. Some Windows tools and older PowerShell pipelines emit UTF-16 or prepend a byte-order mark, which changes every digest.
• Line endings. A file saved with Windows CRLF endings hashes differently from the same file with LF endings. Git's autocrlf setting can flip this without you noticing.
• Invisible whitespace. Trailing spaces and tabs count. Copying from a rendered web page often strips them; copying from a code editor does not.

Uppercase and lowercase hex are the same value, so a digest that starts 2CF2 matches one that starts 2cf2. Known test vectors help when you port hashing to another language: MD5 of hello is 5d41402abc4b2a76b9719d911017c592, SHA-1 is aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d, and SHA-256 is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.

Command-line and code equivalents

This page hashes text only. For files, or inside scripts, use the native tools:

# Linux / Git Bash
printf '%s' 'hello' | sha256sum
sha256sum archive.tar.gz              # md5sum, sha1sum, sha512sum also exist
# macOS
shasum -a 256 archive.tar.gz
openssl dgst -sha256 archive.tar.gz
# Windows
certutil -hashfile archive.zip SHA256
Get-FileHash archive.zip -Algorithm SHA256     # PowerShell
# Python and Node.js
python3 -c "import hashlib,sys; print(hashlib.sha256(sys.argv[1].encode()).hexdigest())" hello
node -e "console.log(require('crypto').createHash('sha256').update('hello').digest('hex'))"

In browser JavaScript, crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)) gives the same result as this page. The Web Crypto API deliberately omits MD5, which is one reason this tool uses crypto-js instead.

HMAC and the length-extension trap

MD5, SHA-1, SHA-256 and SHA-512 all use the Merkle-Damgård construction. Given hash(secret + message) and the length of the secret, an attacker can compute a valid digest for message + extra data without ever learning the secret. So never build an authentication tag as hash(key + data). Use HMAC (RFC 2104), which wraps the hash twice with the key; HS256 in a JSON Web Token is exactly HMAC-SHA-256. SHA-512/256 and the SHA-3 family are not vulnerable to length extension, but HMAC remains the portable answer.

Everything on this page runs locally, so it is safe to hash tokens, connection strings or customer identifiers in order to compare them without pasting the originals anywhere else.

1. Type or paste the text to hash into the input box.
2. All four digests (MD5, SHA-1, SHA-256, SHA-512) recompute as you type; there is no submit button.
3. Use the copy icon next to a digest to put it on the clipboard as lowercase hex.
4. To hash a file, use a command-line tool such as sha256sum or Get-FileHash. Pasting the Base64 text of a file here hashes that text, not the file.

• Checking a known test vector while implementing or porting hashing in another language.
• Comparing two secrets or tokens without displaying them: hash both and compare the digests.
• Building a stable cache key or ETag from a canonical string such as a sorted query.
• Deduplicating records by hashing a normalised version of their text.
• Fingerprinting a configuration string so a monitoring job can detect drift.
• Showing a teammate why echo and printf produce different checksums for the same word.