Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text — all client-side.
Hashing transforms any input into a fixed-length string of characters. Unlike encryption, hashing is a one-way function — you can't reverse a hash to recover the original input. The same input always produces the same hash, but even a tiny change in input produces a completely different output.
MD5 (128-bit) and SHA-1 (160-bit) are legacy algorithms — fast but vulnerable to collision attacks, where two different inputs produce the same hash. SHA-256 (256-bit) and SHA-512 (512-bit) are part of the SHA-2 family and are considered secure for current use.
Hashing is used for password storage (never store passwords in plain text), data integrity verification (checksums), digital signatures, and blockchain. When you "check" a password, the system hashes your input and compares it to the stored hash — the actual password is never compared or stored. This tool generates all four common hash types using the browser's Web Crypto API.
This tool in other languages:
Français:
Générateur de hachage
Español:
Generador de hash
Deutsch:
Hash-Generator
Português:
Gerador de hash
日本語:
ハッシュ生成ツール
中文:
哈希生成器
한국어:
해시 생성기
العربية:
مولد التجزئة
Paste or type your text in the input box and click Generate Hashes. The tool produces MD5, SHA-1, SHA-256, and SHA-512 hashes of your input, all at once. Click Copy next to any hash to grab it.
MD5 (128-bit) and SHA-1 (160-bit) are considered cryptographically broken — fine for checksums, bad for security. SHA-256 (256-bit) and SHA-512 (512-bit) are part of the SHA-2 family, widely considered secure. The larger the bit size, the slower to compute but harder to attack.
Only for non-security uses: file integrity checks, cache keys, deduplication, and checksums where you're verifying the file hasn't been accidentally corrupted. Never use MD5 for passwords, digital signatures, certificates, or anywhere an attacker could benefit from forging collisions.
No — hashes are one-way functions. However, for short or common inputs (words, short passwords), attackers use precomputed tables (rainbow tables) to look up the original. That's why passwords need to be hashed with a salt and a slow algorithm like bcrypt, not plain SHA-256.
SHA-256 is too fast — an attacker with a GPU can try billions of guesses per second. For password storage, use a slow, memory-hard algorithm like bcrypt, scrypt, or Argon2 — they're designed to be expensive so brute-force attacks are economically infeasible.