Hash Generator (MD5, SHA-1, SHA-256, SHA-512)

What is Hash Generator?

A cryptographic hash function turns any input into a fixed-size fingerprint. It's one-way (you can't reverse it) and deterministic (same input always produces the same output). Common uses: checksums to detect corruption, fingerprints for change detection, and — with careful key-derivation functions — password storage.

How to generate hashes online

1. 1Type or paste your text into the input field.
2. 2MD5, SHA-1, SHA-256, and SHA-512 hashes update live as you type.
3. 3Click any hash's Copy button to grab it.
4. 4Toggle between UTF-8 and hex input if your source is a hex-encoded binary.

Use Cases

Code Examples

async function sha256(text) {
  const bytes = new TextEncoder().encode(text);
  const hash = await crypto.subtle.digest("SHA-256", bytes);
  return [...new Uint8Array(hash)].map(b => b.toString(16).padStart(2, "0")).join("");
}

import hashlib
hashlib.md5(b"hello").hexdigest()
hashlib.sha256(b"hello").hexdigest()

import (
    "crypto/sha256"
    "encoding/hex"
)

sum := sha256.Sum256([]byte("hello"))
fmt.Println(hex.EncodeToString(sum[:]))

echo -n "hello" | md5sum
echo -n "hello" | sha256sum
shasum -a 256 file.zip

Key Concepts

MD5

128-bit output. Cryptographically broken since 2004 — collisions are cheap. Fine as a non-security fingerprint (e.g. dedup); never for signatures or passwords.

SHA-1

160-bit output. Collision attack demonstrated by Google in 2017. Deprecated for signatures; still fine as a git object id.

SHA-256 / SHA-2

256-bit output. The modern default. No practical attack. Used by Bitcoin, TLS certificates, Git object hashes (as of 2020+).

SHA-3 / Keccak

A different construction from SHA-2, standardized in 2015. Equally secure, less widely deployed. Same 256/384/512 output sizes.

Password hashing

Never use plain SHA-256 for passwords. Use bcrypt, scrypt, or Argon2 — they're deliberately slow and salt each password separately.

Tips & Best Practices

• ▸Always verify against SHA-256 or better. MD5 and SHA-1 checksums are still common but should be treated as advisory only.
• ▸Hash the raw bytes, not the text. `sha256("hello")` and `sha256("hello ")` (trailing space) are wildly different — invisible whitespace bites people.
• ▸When comparing hashes in code, use a constant-time comparison (`crypto.timingSafeEqual` in Node) to avoid timing side-channels.
• ▸For file hashing in the browser, stream chunks through `crypto.subtle.digest` — loading a 1GB file into memory first is a bad idea.