Copied!
Back
Security Tool

Hash Generator — MD5, SHA-1, SHA-256, SHA-512

Generate cryptographic hashes from any text using MD5, SHA-1, SHA-256, and SHA-512 algorithms instantly. This free online hash generator uses the Web Crypto API to compute hashes directly in your browser — no data is sent to any server. Compare hashes side by side, verify checksums, and learn which hashing algorithm to use for your use case. Works offline, no signup required.

hash-generator.tool
0 characters · 0 bytes
MD5 Enter text above...
SHA-1 Enter text above...
SHA-256 Enter text above...
SHA-512 Enter text above...

How to use the hash generator

Compute MD5, SHA-1, SHA-256, and SHA-512 hashes of text or files for checksums, ETags, content-addressing, and integrity verification. All hashing happens in your browser via the Web Crypto API — files never upload, text never leaves the page.

Common mistakes to avoid

Frequently Asked Questions

Is MD5 still safe to use in 2026?
MD5 is cryptographically broken — practical collision attacks have been demonstrated since 2004. Do not use MD5 for security purposes like password hashing, digital signatures, or certificate verification. MD5 is still acceptable for non-security uses: file checksums (detecting accidental corruption), cache keys, deduplication, and ETags. For any security-related use, switch to SHA-256 or SHA-3.
What is the difference between MD5, SHA-1, and SHA-256?
MD5 produces a 128-bit (32 hex character) hash — cryptographically broken since 2004. SHA-1 produces 160-bit (40 hex character) hashes — broken since the SHAttered attack in 2017. SHA-256 (SHA-2 family) produces 256-bit (64 hex character) hashes and remains secure for all purposes as of 2026. SHA-512 provides 512-bit hashes (128 hex characters) and can be faster than SHA-256 on 64-bit systems.
Can you reverse an MD5 or SHA-256 hash?
No. Cryptographic hash functions are mathematically one-way — you cannot reverse them to get the original input. However, short or common inputs can be found via rainbow tables or brute-force attacks. This is why password hashing uses intentionally slow algorithms like bcrypt or Argon2id with unique salts, not raw MD5 or SHA-256.
Should I use SHA-256 for password hashing?
No. SHA-256 is too fast for passwords — an attacker can try billions of guesses per second on modern GPUs. Use purpose-built password hashing algorithms: Argon2id (recommended), bcrypt, or scrypt. These are intentionally slow, memory-hard, and include automatic salting to prevent rainbow table attacks. Argon2id is the current OWASP recommendation and the winner of the Password Hashing Competition.
What is a hash collision?
A collision occurs when two different inputs produce the identical hash output. For MD5 and SHA-1, researchers can deliberately craft colliding inputs (e.g., the SHAttered attack created two different PDFs with the same SHA-1 hash). This breaks digital signatures and certificate integrity. SHA-256 has no known practical collision attacks — it remains resistant to both collision and preimage attacks.
How do I verify a file checksum?
On Windows: certutil -hashfile filename SHA256. On macOS: shasum -a 256 filename. On Linux: sha256sum filename. Compare the output with the expected hash from the file publisher. If they match, the file hasn't been tampered with or corrupted during download. You can also use the "File Hash" tab above to compute the hash directly in your browser.

Related Tools

b64
Base64 Encoder / Decoder
Encode and decode Base64 strings
jwt
JWT Decoder
Decode and inspect JWT tokens
uid
UUID Generator
Generate v4 UUIDs in bulk