A cryptographic hash is a fixed-size string produced from input data. The same input always produces the same hash, but it is impossible to reverse a hash back to the original data.

Which hash algorithm should I use?

Use SHA-256 or SHA-512 for security. SHA-1 is deprecated for security purposes. Use checksums (SHA-256) for file integrity verification.

MD5 vs SHA-256 — which should I use?

Use SHA-256 (or SHA-3) for integrity checks and digital signatures. MD5 has been broken for collision resistance since 2004 and SHA-1 since 2017, so neither is safe where an attacker could craft inputs. Use neither for password storage.

Can I reverse a hash to recover the original input?

No. Cryptographic hashes are one-way functions, so there is no decrypt operation. Attackers only recover inputs by guessing — brute force, dictionary or precomputed rainbow tables — which is why salting and slow hashing matter for passwords.

Should I use these hashes to store passwords?

No. Fast hashes like MD5, SHA-1 and SHA-256 let attackers test billions of guesses per second. Store passwords with a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2 instead.

Are my inputs hashed locally in the browser?

Yes. Hashing runs entirely on your device using the Web Crypto SubtleCrypto API (with a small library for legacy algorithms), so the text or file you hash is never sent to any server.

What does it mean that a hash algorithm has a collision?

A collision is two different inputs that produce the same digest. A secure hash makes finding one computationally infeasible; MD5 and SHA-1 fail this, which is why they are deprecated for signatures and certificates.

Hash Generator — SHA-256, SHA-512 Online

How to use Hash Generator

The Hash Generator creates cryptographic hash digests from text or files in one click, supporting MD5, SHA-1, SHA-256, SHA-384 and SHA-512. Enter any string or upload a file and receive the corresponding hash immediately — ideal for generating ETags, building content-addressed caches, verifying download integrity and constructing HMAC signatures for API authentication.

Select the hash algorithm from the dropdown (SHA-256 recommended for security).
Choose whether to hash a text string or a local file.
Enter the text or drag and drop a file onto the upload zone.
Optionally toggle uppercase/lowercase hex output.
Click Generate Hash and copy the resulting digest.
To verify a file, paste the expected checksum and click Verify — the tool confirms a match or mismatch.

Your data never leaves your device — 100% private processing.

Using hashes for file integrity verification

Software download pages typically publish a SHA-256 or SHA-512 checksum alongside each binary. After downloading, you compute the hash of the local file and compare it with the published value. An identical digest proves the file was not corrupted in transit and has not been tampered with by a man-in-the-middle. This is particularly important for installers and OS images where a compromised file could silently install malware.

HMAC and keyed hashes

HMAC (Hash-based Message Authentication Code) extends a cryptographic hash by incorporating a secret key, producing a value that can only be reproduced by a party who knows the key. HMAC-SHA256 is the signature algorithm used by AWS Signature Version 4, GitHub webhook payloads and many REST API authentication schemes. The key input prevents an attacker from forging a valid MAC even if they know the algorithm and message content.

Worked examples

MD5 of "hello"

Inputs: text 'hello' · MD5

Result: 5d41402abc4b2a76b9719d911017c592

SHA-256 of "hello"

Inputs: text 'hello' · SHA-256

Result: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Output length by algorithm

Inputs: same input, different algorithm

Result: MD5 32 hex · SHA-1 40 hex · SHA-256 64 hex

Hash algorithm comparison

Hash algorithm comparison
Algorithm	Output length	Collision status	Use today?
MD5	128-bit (32 hex)	Broken since 2004	No — non-security checksums only
SHA-1	160-bit (40 hex)	Broken since 2017	No — deprecated for signatures
SHA-256	256-bit (64 hex)	Secure	Yes — integrity, signatures, TLS
SHA-512	512-bit (128 hex)	Secure	Yes — high-security workloads

Glossary

SHA-256: A 256-bit cryptographic hash function from the SHA-2 family, widely used in TLS, code signing and blockchains.
HMAC: Hash-based Message Authentication Code — a keyed hash used to authenticate message integrity.
Hex encoding: Representing each byte of a digest as two hexadecimal digits, producing a string twice the byte length.
ETag: An HTTP header containing a hash of a resource's content, used for cache validation.
Key derivation: Using a hash function with added salt and iterations (bcrypt, Argon2) to safely derive keys from passwords.

Related Developer Tools

Base64 Encoder & Decoder

Encode text or files to Base64, or decode Base64 strings back to text in seconds. Free, private, and fully in-browser now.

JWT Decoder

Decode and inspect JSON Web Tokens (JWT) online. View header, payload, and expiry. 100% client-side — your token never leaves your browser.

HMAC Generator

Generate HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 and a secret key. Uses the Web Crypto API. Free and private.

Bcrypt Hash Generator & Checker

Generate bcrypt password hashes and verify a password against a hash online. Adjustable cost factor. Free, private bcrypt tool in your browser.

Password Strength Tester

Test how strong a password is with an entropy score and estimated crack time. Get tips to improve it. Runs locally — Free and private.

JSON Formatter & Validator

Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.

Explore all Developer Tools.

Hash Generator

How to use Hash Generator

Using hashes for file integrity verification

HMAC and keyed hashes

Worked examples

Hash algorithm comparison

Glossary

Related reading

Frequently Asked Questions

Why use Hash Generator?

Common use cases

Get weekly tool tips & updates

Related Developer Tools