hash-generator
Type or paste any text to instantly compute its MD5, SHA-1, SHA-256, and SHA-512 hash values. All computation runs locally in your browser — nothing leaves your machine.
client-side only Web Crypto API no signup
input.txt
hash-values.json
// which algorithm to use
- SHA-256 — The right default for almost everything: verifying file integrity, signing tokens, storing password hashes (via a slow KDF like bcrypt, not raw SHA-256), generating content-addressable identifiers. Part of the SHA-2 family, currently unbroken, and what the Web Crypto API and .NET's
SHA256.HashData()expose natively. - SHA-512 — Same security properties as SHA-256 but produces a 512-bit (128-character hex) output. Useful when you need a longer hash for additional collision resistance, or when hashing large data where SHA-512 is faster than SHA-256 on 64-bit hardware due to word size.
- SHA-1 — Deprecated for all security-sensitive purposes since 2017 (collision attacks are practical). Still widely used for non-security checksums (Git commit IDs use SHA-1), and many older systems still emit SHA-1 hashes you may need to verify. Don't use it for new security work.
- MD5 — Cryptographically broken since the mid-2000s (deliberate collisions can be constructed in seconds). Exists here for compatibility with legacy systems, checksums, and formats that still emit MD5 hashes (like some database file integrity checks or older package registries). Never use MD5 to protect security-sensitive data.
// hashing vs. encryption — they are not the same thing
// how this tool computes the hashes
SHA-1, SHA-256, and SHA-512 are computed via the browser's SubtleCrypto API (crypto.subtle.digest()), which uses the browser's native cryptographic implementation — no third-party library involved. MD5 is not part of the Web Crypto API (it's considered legacy), so this tool uses a pure-JavaScript MD5 implementation. All inputs are UTF-8 encoded before hashing, matching how .NET's Encoding.UTF8.GetBytes() + SHA256.HashData() behaves.
A hash is a one-way function: the same input always produces the same output, but you cannot reconstruct the input from the hash. Encryption is two-way: a key encrypts data and a key decrypts it back. If you "hash" a password to store it in a database, that's correct — storing encrypted passwords means you have a key that can decrypt them, which is a security liability. If you need to be able to recover the original value, you want encryption, not hashing.