Hash Generator

One input, five outputs, and a byte question underneath all of them

A hash function takes any input and produces a fixed-length string that changes completely if even one character of the input changes. This page runs the input through five of them at once — MD5, SHA-1, and SHA-256, SHA-384 and SHA-512 from the SHA-2 family — because different systems still expect different ones, and it costs nothing to compute all five from the same input.

MD5 and SHA-1 are both cryptographically broken — collisions have been demonstrated for both, most famously Google's SHAttered attack against SHA-1 in 2017 — so neither belongs anywhere a hash needs to resist a deliberate forgery: password storage, digital signatures, certificate fingerprints. They still show up constantly for a different reason: checking that a file was not corrupted or truncated by accident, where nobody is trying to fake a match. That is why this page still computes them rather than dropping them.

Every hash here is computed over the input's UTF-8 bytes, using the browser's own TextEncoder — the same bytes a command-line tool like sha256sum or openssl dgst hashes when you point it at a UTF-8 text file. That distinction only matters once a character falls outside plain ASCII; for pure ASCII text, UTF-8 and a naive UTF-16 read happen to agree, which is exactly why the mismatch surprises people the first time it does not.

Everything happens in your browser. Whatever you paste here — a password you are checking, a config value, an API key — is never sent anywhere.

Hashing some text

1. Type or paste the text – All five hashes update as you type, computed from the exact bytes on the left.
2. Copy the one you need – Each hash has its own copy button — no need to select a long hex string by hand.
3. Watch for a trailing newline – If you are comparing against a command-line tool's output, check whether that command added a newline your paste did not — see the pro tip below.

echo "text" | sha256sum and this page will not agree, and it is not a bug in either. echo appends a trailing newline by default, so the shell actually hashes text\n, five bytes longer than what you pasted here. Use echo -n, or printf without a trailing \n, to hash exactly the text and nothing else — the single most common reason a hash "does not match" when the text looks identical.

The same short string, five ways

The word "abc" — short enough to spot every character, and the exact string every hash function's own published test vectors use.

abc

MD5
900150983cd24fb0d6963f7d28e17f72

SHA-256
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

When you need this

Checking a password against a known hash

A legacy system or an old export sometimes stores a password as an MD5 or SHA-1 hash rather than a proper salted one. Hashing a candidate password here and comparing it to the stored value confirms a match without writing a script for a one-off check — worth remembering that a bare MD5 or SHA-1 hash of a password is itself insecure practice, not something to replicate in anything new.

Generating a cache key or an idempotency key

A stable, short identifier derived from a request body or a config value — hash the canonical text and use the result as a key, so identical inputs always produce identical keys.

Confirming two pieces of text are byte-identical

Two long strings that look the same at a glance — an API token, a base64 blob, a config value copied twice — either hash to the same value or they are not identical, without eyeballing every character.

Verifying a downloaded file's checksum

For a whole file rather than a string of text, use File Checksum instead — it reads the file directly rather than needing you to paste its contents.

What this page does

• Computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 simultaneously from one input, each with its own copy button.
• Hashes UTF-8 bytes via TextEncoder, matching what sha256sum and openssl dgst compute on a text file — not a naive read of JavaScript's UTF-16 code units.
• SHA-1 through SHA-512 go through the browser's own crypto.subtle.digest, the platform's real implementation rather than a JavaScript re-implementation.
• Runs entirely in your browser — nothing you type, including a password you are checking, is sent anywhere.

Questions people actually ask

Why does my hash not match what a command-line tool gives me?

Almost always a trailing newline. echo "text" without -n adds one, so the shell hashes one more byte than you think it does. Try printf "%s" "text" | sha256sum instead, which adds nothing — see the pro tip above for the full explanation.

Is MD5 safe to use?

Not for anything where someone might deliberately try to produce a matching hash — RFC 6151 documents the practical collision attacks that broke it for that purpose over a decade ago. It is still fine for catching accidental corruption, like confirming two copies of a file are identical, where nobody is trying to fool it.

Should I use this to hash passwords for storage?

No. None of the algorithms on this page are designed for password storage — they are all fast to compute, which is exactly the wrong property when the goal is making a brute-force guess expensive. Use a purpose-built password hash like bcrypt, Argon2, or scrypt instead, with a per-user salt.

Why are the hashes lowercase?

Lowercase hex is the near-universal convention for a hash digest's display form — what sha256sum, git, and most package managers all print. Hex digits are case-insensitive as data, so uppercase them yourself if a system you are pasting into specifically expects that.

Related tools

Specifications and references

• FIPS 180-4 — Secure Hash Standard – The official specification for the SHA-2 family
• RFC 1321 — The MD5 Message-Digest Algorithm – Including the "abc" test vector this page's own example uses
• MDN — SubtleCrypto.digest() – The browser API behind the SHA family on this page