MD5 · SHA-1 · SHA-2 · side by side
Hash Generator
Type text or choose a file and get its MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes at once. Paste a checksum and the tool tells you which algorithm made it.
- MD5legacy · broken for security
- -
- SHA-1legacy · broken for security
- -
- SHA-256
- -
- SHA-384
- -
- SHA-512
- -
Hashed in your browser: SHA with crypto.subtle.digest(), MD5 with our published RFC 1321 code. Nothing is uploaded. Verify it
What a Hash Generator Does
A cryptographic hash function turns input of any length into a fixed-length output, the hash or digest. The same input always gives the same hash; change one character and the hash changes completely. The process is one-way: there is no key and no way to turn the hash back into the input.
That makes hashes useful as fingerprints - to check that a file or message has not changed, to find duplicates, or as a building block of signatures. It also means hashing is not encryption: a hash keeps nothing secret and cannot be decrypted. The hashing vs encryption guide compares the two.
Hash Algorithms Compared
The same five-letter word, hello, through each algorithm - the values are computed by the tool's own code:
| Algorithm | Output | Standard | Security status |
|---|---|---|---|
| MD5 | 128 bits, 32 hex | RFC 1321 (1992) | Broken: practical collisions since 2004 |
| SHA-1 | 160 bits, 40 hex | FIPS 180-4 | Broken: practical collision in 2017; NIST phase-out by 2030 |
| SHA-256 | 256 bits, 64 hex | FIPS 180-4 (SHA-2) | No practical collision published |
| SHA-384 | 384 bits, 96 hex | FIPS 180-4 (SHA-2) | No practical collision published |
| SHA-512 | 512 bits, 128 hex | FIPS 180-4 (SHA-2) | No practical collision published |
- MD5:
5d41402abc4b2a76b9719d911017c592 - SHA-1:
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d - SHA-256:
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 - SHA-384:
59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f - SHA-512:
9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043
A longer output gives more possible values, which makes collisions harder to find by brute force. But MD5 and SHA-1 were broken by weaknesses in their design, not only by their length - see RFC 6151 for MD5.
SHA-1: Legacy Only
SHA-1 produces a 160-bit hash and was the standard choice for signatures and certificates for years. In February 2017 researchers from CWI Amsterdam and Google published SHAttered, the first practical SHA-1 collision: two different PDF files with the same SHA-1. In December 2022 NIST announced that SHA-1 should be phased out by 31 December 2030, in favour of SHA-2 or SHA-3.
It is still useful for one thing: checking a file against an SHA-1 checksum that someone published years ago. For anything new, or anything an attacker could influence, use SHA-256.
SHA-512 and SHA-384: the Longer SHA-2
SHA-512 is the SHA-2 function with the longest output: 512 bits, 128 hex characters. It works on 64-bit words, where SHA-256 works on 32-bit words. FIPS 180-4 defines SHA-384 as SHA-512 with different starting values, cut to 384 bits - so the two are close relatives, and SHA-384 is not simply the first 96 characters of SHA-512.
Use SHA-512 or SHA-384 when a format or protocol asks for them. For an ordinary checksum, SHA-256 is the most widely published, so it is the easiest to compare.
Which Algorithm Made This Checksum?
The length of a hex checksum narrows it down: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. Length alone is not proof - other algorithms share some of these lengths - so the tool goes one step further: paste the checksum, add the file or text, and it checks the value against every algorithm and names the one that matches.
To verify a single download step by step, the SHA-256 generator and the MD5 generator each have a checksum field and command-line equivalents.
Not for storing passwords
Every algorithm on this page is designed to be fast. The OWASP Password Storage Cheat Sheet warns that fast algorithms are not suitable for password storage, because they let attackers test guesses quickly. Store passwords with Argon2id, scrypt, bcrypt or PBKDF2, with a unique salt per password.
Hash Generator FAQs
Which hash algorithm should I use?
The one the other side expects - a checksum only means something when both sides use the same algorithm. When you get to choose, use SHA-256. Use MD5 or SHA-1 only to compare with an old checksum that was published in that format.
Why does this page include MD5 and SHA-1 if they are broken?
Because many downloads and older systems still publish MD5 or SHA-1 checksums, and checking a file against them still detects accidental corruption. Both are marked as legacy in the tool. Do not use them for anything an attacker could influence - see the MD5 vs SHA-1 vs SHA-256 guide.
Can a hash be reversed or decrypted?
No. A hash function has no key and no decryption step. What people call "cracking" a hash is guessing inputs and comparing results, which works only when the input is short or predictable.
Why do I get a different hash than another tool?
Usually the input differs: a trailing space or newline, Windows line endings (CRLF) versus LF, or a different text encoding. This tool hashes text as UTF-8, and browsers represent line breaks in text fields as LF. A file is hashed byte for byte, so file hashes match command-line tools exactly.
Can I hash passwords for my database here?
You should not store MD5, SHA-1 or SHA-2 hashes of passwords. They are fast by design, and OWASP warns that fast hashes let attackers test guesses quickly. Use a password hashing algorithm such as Argon2id, bcrypt or PBKDF2 in your server code - see how passwords should be stored.
Is the text or file sent anywhere?
No. SHA-1 and SHA-2 run in your browser with crypto.subtle.digest(), MD5 with our own published code, and files are read in a background worker on your device. No request is made, and the text is cleared when you leave the page.
Related guides
MD5 vs SHA-1 vs SHA-256
Hashing vs Encryption
