Hash Generator

How to use this hash generator

1. Type or paste any text into the box above, or upload a file to hash instead.
2. All five hashes (MD5, SHA-1, SHA-256, SHA-384, SHA-512) update instantly as you type or as soon as a file is selected.
3. Click "Copy" next to any hash to copy it to your clipboard.

What is a hash function?

A hash function turns any input into a fixed-length string of characters. The same input always produces the same output, and changing even one character produces a completely different hash — useful for verifying file integrity or comparing values without exposing the original data.

Is MD5 still safe to use?

MD5 and SHA-1 are considered cryptographically broken for security purposes (they're vulnerable to collision attacks) and are included here only for checksums and legacy compatibility. For anything security-related, use SHA-256 or higher.

What actually happens inside a hash function

A cryptographic hash function takes an input of any size — a single character or a multi-gigabyte file — and always produces an output of a fixed length: SHA-256 always outputs 256 bits (64 hex characters), regardless of whether the input was one byte or one gigabyte. The function is deterministic (the same input always produces the same hash) but designed so that changing a single bit anywhere in the input scrambles the entire output unpredictably, a property called the avalanche effect. This is what makes hashes useful for integrity checks: comparing two hashes is a reliable stand-in for comparing two entire files byte-by-byte, without ever needing to transmit or store the files themselves.

Why MD5 and SHA-1 are broken, specifically

"Broken" doesn't mean a hash can be reversed back into its original input — that's still not possible for MD5 or SHA-1. What's broken is collision resistance: the ability to find two different inputs that produce the same hash. Researchers demonstrated a practical MD5 collision in 2004, and in 2017 Google and CWI Amsterdam published the "SHAttered" attack, producing two different PDF files with an identical SHA-1 hash. Once an algorithm's collision resistance is broken, an attacker can potentially substitute a malicious file for a legitimate one while keeping the same hash — which defeats the entire purpose of using a hash to verify authenticity or detect tampering. Both algorithms are still fine for non-adversarial uses, like generating a quick checksum to catch accidental file corruption, but shouldn't be trusted anywhere a malicious actor might try to engineer a collision on purpose.

Hashing vs. encryption vs. encoding — a common mix-up

These three terms get used interchangeably, but they solve completely different problems. Encoding (like Base64) is fully reversible and isn't meant to hide anything — it just changes the representation of data. Encryption is also reversible, but only with the correct key, and it's meant to keep data confidential while in transit or storage. Hashing is one-way by design — there's no key that turns a hash back into its input, because that's not what it's for. A hash answers "does this match what I expect?", not "what was the original value?" — which is exactly why you'll see hashes used for password verification (comparing hashes, never storing the password itself) and file integrity checks, but never as a way to protect a secret you'll need to retrieve later.

Why this tool isn't the right choice for hashing passwords

Everything above is accurate for general-purpose hashing, but storing user passwords is a specialized case with an extra requirement: resistance to brute-force guessing. SHA-256 and its relatives are deliberately fast, which is exactly the wrong property for password storage — a fast hash lets an attacker who steals a password database try billions of guesses per second on modern hardware. Purpose-built password hashing functions like bcrypt, scrypt, and Argon2 are deliberately slow and memory-intensive, and combine the password with a unique random salt per user to prevent precomputed lookup-table attacks. If you're building a login system, use one of those instead of feeding a password directly into SHA-256 — this tool is meant for checksums, deduplication, and integrity verification, not for authentication systems.

Limitations of this tool

This generator computes general-purpose cryptographic hashes using the browser's native Web Crypto API for SHA-1 through SHA-512, plus a local JavaScript implementation for MD5 (which isn't part of the Web Crypto standard). It doesn't support keyed hashing (HMAC) or salting, both of which matter for security-sensitive uses beyond simple integrity checks. File hashing happens entirely in browser memory, so extremely large files (many hundreds of MB) may be slow or hit the practical limits of what the browser can process at once — for routine text and moderately sized files, this has no real impact.