Free Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes instantly from text or files — entirely in your browser.

Encoding:

Which hash should you actually use?

MD5 and SHA‑1 are broken for anything security‑adjacent. MD5 collisions have been trivial to generate since Wang's 2004 attack; SHA‑1 fell in 2017 when Google's SHAttered demonstrated two PDFs with the same SHA‑1 for about $110k of GPU time. Both are still fine as non‑security checksums — verifying a file downloaded correctly, deduplicating cached responses, keying a cache — because there's no adversary trying to forge collisions. Git still uses SHA‑1 for object addressing for exactly this reason.

SHA‑256 is the current default for integrity: it's what Bitcoin uses, what most Linux distros publish for ISO verification, and what subresource integrity attributes on <script> tags expect. SHA‑512 produces a longer digest but is often faster on modern 64‑bit CPUs because it processes 8 bytes per round versus SHA‑256's 4 — the tradeoff is only worth it if you're hashing a lot of data. For passwords, never use any of these directly; use bcrypt, scrypt, or argon2, which add tunable work factors.

All hashing here happens in the browser via the Web Crypto API — nothing is uploaded. That matters when you're hashing a secret, a leaked credential you're checking against a breach list, or anything you'd rather not send over the wire even to a service you trust.

Frequently Asked Questions

What is a cryptographic hash function?

A cryptographic hash function takes any input data and produces a fixed-length string of hexadecimal characters called a digest. The same input always produces the same output, but even a single-character change produces a completely different hash. Hash functions are one-way: you cannot reverse-engineer the original data from the hash value.

What is the difference between MD5 and SHA-256?

MD5 produces a 128-bit (32-character) hash and is fast but considered cryptographically broken because collisions can be generated intentionally. SHA-256 produces a 256-bit (64-character) hash and is part of the SHA-2 family designed by the NSA. SHA-256 is collision-resistant and widely used in TLS certificates, blockchain, and software verification. Use SHA-256 when security matters; MD5 is still fine for non-security checksums like detecting accidental file corruption.

How do I verify file integrity with a hash?

Generate a hash of the original file before transferring or storing it, then generate the hash again after. If both hashes match, the file is identical. Software distributors publish SHA-256 checksums alongside downloads so you can verify the file was not tampered with or corrupted during download.

Should I use hashing for passwords?

Plain hash functions like SHA-256 are too fast for password storage because attackers can try billions of guesses per second. Passwords should be hashed with a purpose-built algorithm like bcrypt, scrypt, or Argon2 that adds a salt and a deliberate work factor. This tool is useful for checksums and data integrity, not for securely hashing passwords.

What is collision resistance and why does it matter?

Collision resistance means it is computationally infeasible to find two different inputs that produce the same hash output. MD5 and SHA-1 have known collision attacks, making them unsuitable for digital signatures and certificate verification. SHA-256 and SHA-512 remain collision-resistant and are the current standard for security-sensitive applications.

What is HMAC and how is it different from hashing?

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce an authentication tag. While a plain hash verifies data integrity, an HMAC verifies both integrity and authenticity because only someone with the secret key can generate or verify the tag. HMAC is used in API authentication, JWT tokens, and secure communication protocols.

Is my data safe when using this tool?

All hashing is performed entirely in your browser using the Web Crypto API and JavaScript. No data is sent to any server. Your text and files never leave your device, making this tool safe for sensitive content.