cryptography
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, or SHA-512 hashes from any text input.
What is Hash Generator?
A cryptographic hash function takes an input of any length and produces a fixed-size output — the hash or digest — that uniquely represents the input. The same input always produces the same hash; changing even a single character produces a completely different hash. Hash functions are one-way: you cannot reverse a hash to recover the original input. MD5 and SHA-1 are older algorithms still used for non-security checksums. SHA-256 and SHA-512 are current standards for security-sensitive use cases such as digital signatures, API authentication, and password storage (always combined with a proper key-derivation function like bcrypt or Argon2 for passwords).
How to use Hash Generator
- Paste your text: Type or paste any UTF-8 string into the input field — an API secret, a file path, a password candidate, or any value you want to fingerprint.
- Choose an algorithm and encoding: Select SHA-256 for general security use, MD5 or SHA-1 for legacy checksum compatibility, or SHA-512 for the longest digest. Choose hex for a lowercase hexadecimal string or base64 for a more compact representation.
- Copy the hash: The digest appears instantly. Click Copy to put it on your clipboard. The tool also shows input byte length and digest character length to help you confirm you are using the correct variant.
Frequently asked questions
- Is my input sent to a server?
- No. Hashing runs entirely in your browser using the Web Crypto API. Your text never leaves your device. The REST API endpoint processes input server-side in an isolated, stateless function with no logging.
- Which algorithm should I use?
- Use SHA-256 for new projects — it is the current standard for digital signatures, API authentication, and data integrity. Use MD5 or SHA-1 only when a legacy system requires it; both are broken for collision resistance but still acceptable for non-security checksums like file integrity verification. Use SHA-512 when you need a 512-bit digest or when a framework specifically requires it.
- Can I hash a file instead of text?
- This tool hashes UTF-8 text. To hash a file in Node.js: createHash('sha256').update(fs.readFileSync('file')).digest('hex'). On macOS or Linux: sha256sum filename. On Windows: Get-FileHash filename -Algorithm SHA256.
- What is the difference between hex and base64 output?
- Both represent the same binary digest in different encodings. Hex uses lowercase letters a-f and digits 0-9, producing a string twice as long as the digest in bytes (64 characters for SHA-256). Base64 uses A-Z, a-z, 0-9, +, and /, producing a shorter string (44 characters for SHA-256 including padding). Hex is easier to read and compare visually; base64 is more compact and commonly used in HTTP headers and JWT signatures.
- Are MD5 and SHA-1 safe to use?
- Not for security purposes. MD5 has known collision vulnerabilities — two different inputs can produce the same hash — making it unsuitable for digital signatures, certificate verification, or password hashing. SHA-1 is similarly broken for collision resistance. Both are still widely used for non-security checksums (e.g. cache busting, deduplication, ETags) where collision attacks are not a concern.
- How do I hash a password securely?
- Do not use MD5, SHA-1, SHA-256, or SHA-512 to hash passwords directly. These algorithms are fast, which makes them easy to brute-force. Use a purpose-built key derivation function: bcrypt, Argon2id, or scrypt. These are intentionally slow and include a salt to prevent rainbow table attacks. All major web frameworks include a built-in password hashing library.
- What is HMAC and how is it different from a plain hash?
- HMAC (Hash-based Message Authentication Code) is a hash computed over both the message and a secret key, producing an authentication tag that proves both the content and the identity of the sender. A plain SHA-256 hash proves only content integrity — anyone can compute it. HMAC-SHA-256 requires knowing the secret key, making it suitable for API request signing, webhook verification, and session tokens.