Hash Generator
RUNS LOCALLYGenerate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests in the page, in hexadecimal and base64. Two of those algorithms are broken and are offered anyway, because checksums and legacy manifests still use them — so each one carries a plain verdict on what it is and is not safe for.
Your tool input is processed locally in your browser and is not intentionally uploaded to our servers. Advertising and analytics providers may still process normal page, device, cookie and network information.
How to use the Hash Generator
- Paste or type the text to hash. It is encoded as UTF-8, which is what most systems use.
- Choose the algorithms. SHA-256 is the sensible default if you have no reason to prefer another.
- Read the verdict beside each result before relying on it, particularly for MD5 and SHA-1.
- Copy in hex or base64. Integrity attributes and some manifests expect base64 rather than hex.
A worked example, and what it shows
The example hashes a short line containing an accented character, with MD5 and SHA-256 selected. The accent is deliberate: it makes the difference between characters and bytes visible, which is the usual explanation when two systems disagree about a hash.
The character count and byte count differ, and an advisory explains why and names the encoding. MD5 produces a digest and is simultaneously marked broken, which is the honest position: it works, and it is not security.
Press Example in the workspace above to load it.
Common questions about the Hash Generator
Is MD5 safe to use?
Not for anything security-related. Collisions have been producible in seconds since 2004, so anyone who can influence the input can produce two files with the same digest. It remains reasonable for detecting accidental corruption, cache keys and ETags, which is why it is offered here at all.
Why do I get a different hash from another tool?
Encoding or whitespace, nearly always. A digest is taken over bytes, so the same text in UTF-8 and UTF-16 hashes differently, and a trailing newline from a file or a copy is hashed like any other byte. This tool reports both the character and byte counts so the difference is visible.
What about SHA-1 — is that still fine?
No. A practical collision was demonstrated in 2017 and has only got cheaper since. Browsers and certificate authorities abandoned it years ago. Git still uses it to name objects, but that is a checksum against accidental corruption rather than a claim that it resists an attacker.
Should I use SHA-512 instead of SHA-256?
Only if something you are integrating with asks for it. SHA-512 is wider and often faster on 64-bit hardware, but SHA-256 has no known practical weakness and far more systems expect it. Choosing the less common option for its own sake tends to create integration work rather than security.
Does my input leave the browser?
No. Your tool input is processed locally in your browser and is not intentionally uploaded to our servers. Advertising and analytics providers may still process normal page, device, cookie and network information. Hashing happens in the page, which matters if the value you are checksumming is itself sensitive.