Dev Tools
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text or a file, entirely on your device.
| Algorithm | Hash | |
|---|---|---|
| MD5 | – | |
| SHA-1 | – | |
| SHA-256 | – | |
| SHA-512 | – |
Related: the hash identifier if you have a hash and need to know what algorithm made it.
Runs entirely in your browser. Nothing you type or upload leaves your device.
Learn about hashing
What hashing actually does
It takes any input, text or a file, and produces a fixed-length fingerprint of it. The same input always produces the same hash, and changing even a single character produces a completely different, unrelated-looking result.
Which algorithm to use for what
MD5 and SHA-1 are fast and fine for checking basic file integrity, like confirming a download wasn't corrupted, but both are cryptographically broken and should never be used for anything security-sensitive, such as storing a password. SHA-256 and SHA-512 are still considered cryptographically strong for integrity checks and general use today. None of the algorithms offered here are actually meant for password storage, though. Real password hashing needs a slow, salted algorithm like bcrypt or Argon2, since a fast general-purpose hash like these can be brute-forced far too quickly.
Common questions
Why compare files by their hash instead of their actual content? Comparing a short, fixed-length hash is much faster than comparing entire files byte by byte, and for confirming a download matches what the publisher intended, a hash match is effectively as good as a full comparison.
Can two different inputs ever produce the same hash? In theory, yes, for any hash function, since the space of possible inputs is infinite while the output is fixed length. For MD5 and SHA-1 specifically, practical collisions have actually been demonstrated, which is a major reason neither is trusted for security purposes anymore.
Why shouldn't I use this to hash a password for real storage? These are fast, general-purpose hashes, which means modern hardware can try billions of guesses per second against them. Real password storage needs an intentionally slow, salted algorithm built specifically to resist that kind of brute-force attempt.