Hash Generator
MD5, SHA-1, SHA-256, SHA-384, and SHA-512 — updated live as you type. Nothing you paste ever leaves this tab.
0 characters
Nothing you type here is sent anywhere.
What this tool does
Hash Generator takes text and produces its cryptographic hash — a fixed-length fingerprint that changes completely if even one character of the input changes. It supports SHA-1, SHA-256, SHA-384, and SHA-512 (via the browser's built-in Web Crypto), plus MD5, still widely used for file checksums and compatibility with older systems even though it's no longer considered secure.
The result updates as you type, so you can see a hash change in real time as you edit the input.
How to use it
Type or paste text, and pick an algorithm. The hash appears below as a lowercase hex string, updating live. Copy it with one click, or download it as a text file.
MD5 and SHA-1 are labeled directly on their option, not just in this text, because it's easy to reach for either one out of habit without meaning to use it for anything security-sensitive.
Why nothing leaves your device
Hashing is often done on things that shouldn't be sent anywhere — a password before storing its hash, an API secret you're checking against a known value, a file's checksum where the file itself might be sensitive. A server-backed hash tool means that input crosses the network first, which defeats the point if the input was sensitive to begin with.
SHA-1 through SHA-512 run through `crypto.subtle.digest`, a function built into the browser; MD5 runs through a small, self-contained implementation of the public RFC 1321 algorithm. Neither reaches out anywhere — check your network tab while using this and you'll see nothing carrying what you typed.
What this does well — and what it doesn't
This produces correct, standard hashes for every algorithm offered, verified against the published test vectors for each. It's well suited to checksums, comparing two files or strings for equality, and general-purpose fingerprinting.
MD5 and SHA-1 are both cryptographically broken for security purposes — collisions (two different inputs producing the same hash) are practical to construct for both, so neither belongs in anything protecting real security (password storage, digital signatures, integrity checks against a malicious actor). For those, SHA-256 or stronger is the right choice. And a hash is not encryption — there's no way to recover the original text from its hash, by design, so this tool can't be used to decode a hash back into anything.