Online Hash Generator

Q: Should I use MD5 for password hashing?

No. MD5 is cryptographically broken. Use bcrypt, scrypt, or Argon2 for password storage.

Q: Is my data private when I use this tool?

Yes. All hashing runs locally in your browser. Nothing is sent to any server.

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files instantly. Everything runs in your browser — nothing is uploaded or stored.

🔑

Hash Generator

Select text or file input, choose your algorithms, and generate hashes instantly.

Enter Text to Hash

Select Hash Algorithms

Uppercase output Auto-hash as I type

What Is a Hash Function?

A cryptographic hash function is a mathematical algorithm that transforms any input — whether a single character or a multi-gigabyte file — into a fixed-length string of characters called a hash, digest, or checksum. The output length is always the same regardless of input size: SHA-256 always produces a 64-character hexadecimal string, and SHA-512 always produces 128 characters. Hash functions are designed to be one-way operations: it is computationally infeasible to reverse a hash back to its original input.

Hash functions are foundational to modern computing and cybersecurity. They are used to verify file integrity, store passwords securely, create digital signatures, power blockchain technology, and ensure data has not been tampered with in transit. When you download software and the developer provides a SHA-256 checksum, you can run the same hash on your downloaded file and compare the result — if they match, the file is authentic and unmodified.

MD5 vs SHA-1 vs SHA-256 vs SHA-512 — Which Should You Use?

Hash output lengths: MD5 → 128 bits → 32 hex chars SHA-1 → 160 bits → 40 hex chars SHA-256 → 256 bits → 64 hex chars SHA-384 → 384 bits → 96 hex chars SHA-512 → 512 bits → 128 hex chars

MD5 (128-bit)

MD5 was designed in 1991 and produces a 32-character hexadecimal hash. It is extremely fast but is considered cryptographically broken — researchers have demonstrated collision attacks since 2004. MD5 should not be used for security-sensitive purposes such as password hashing or digital signatures. It remains useful for non-security checksumming of files for accidental corruption detection.

SHA-1 (160-bit)

SHA-1 produces a 40-character hash. Deprecated by NIST in 2011, and in 2017 Google's Project Zero demonstrated the first practical SHA-1 collision (the SHAttered attack). No longer accepted for TLS certificates. Remains in legacy systems and version control — Git uses SHA-1 internally, though it is migrating to SHA-256.

SHA-256 (256-bit)

SHA-256 is the current standard for most security applications. Used in TLS/SSL certificates, Bitcoin's proof-of-work algorithm, code signing, and modern password storage systems. No practical collision attacks are known. This is the algorithm to use for any new security application.

SHA-512 (512-bit)

SHA-512 produces a 128-character hash and offers a larger security margin than SHA-256. On 64-bit systems it can actually be faster than SHA-256. Recommended for high-security environments, long-term archival checksums, and applications requiring resistance to future quantum computing threats.

Common Use Cases

File integrity verification. Generate a SHA-256 hash before and after file transfer to confirm it arrived without corruption or modification.
Password storage. Applications store hashes of passwords rather than the passwords themselves — your actual password is never stored in plain text.
Digital signatures. The sender hashes a document, encrypts the hash with their private key, and the recipient verifies it with the public key.
Deduplication. Hashing files allows systems to detect duplicates without comparing content byte by byte.
API integrity (HMAC). Hash-based Message Authentication Codes use a hash function and a secret key to verify API requests have not been tampered with in transit.
Blockchain. Each block contains the hash of the previous block, creating an immutable chain. SHA-256 is used in Bitcoin; Ethereum uses Keccak-256.

Is This Hash Generator Safe to Use?

Yes — completely. This tool uses the Web Crypto API built into your browser for SHA-1, SHA-256, SHA-384, and SHA-512. MD5 is implemented in pure JavaScript since it is not included in the Web Crypto API. No input you enter and no file you select is ever sent to any server — everything happens entirely on your device.

Frequently Asked Questions

Can I reverse a hash back to the original text?

No. Hash functions are one-way. There is no mathematical operation to reverse a hash. Attackers sometimes use rainbow tables — precomputed lists of hashes for common passwords — which is why salting before hashing is essential.

What is a hash collision?

A collision occurs when two different inputs produce the same hash output. A secure hash function makes collisions computationally infeasible to find deliberately. MD5 and SHA-1 are vulnerable to practical collision attacks; SHA-256 and SHA-512 are not.

Why does the same text always produce the same hash?

Hash functions are deterministic — the same input always produces the same output. This is what makes them useful for verification: if you hash a file today and again tomorrow and get the same result, the file has not changed.

Should I use MD5 for password hashing?

Absolutely not. MD5 is cryptographically broken and extremely fast, making brute-force and rainbow table attacks trivial. Use bcrypt, scrypt, or Argon2 for password storage — they are deliberately slow and include built-in salting.

What is the difference between a hash and encryption?

Encryption is reversible — you can decrypt using the correct key. Hashing is irreversible — there is no key and no way to recover the original input. Encryption is for confidentiality; hashing is for integrity.

How large a file can I hash with this tool?

Up to 50 MB. For very large files, a command-line tool like shasum (macOS/Linux) or CertUtil (Windows) is more appropriate.

What is SHA-2 vs SHA-3?

SHA-2 includes SHA-256, SHA-384, and SHA-512 — all supported here. SHA-3 is a newer standard (2015) using a different construction (Keccak sponge) and is not yet as widely deployed. SHA-2 remains the standard for most applications.

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a message authentication code. Unlike a plain hash, an HMAC can only be verified by someone who knows the secret key. Widely used to authenticate API requests and webhooks.

Why is SHA-256 used in Bitcoin?

Bitcoin uses SHA-256 in its proof-of-work mining algorithm. Miners hash a block header repeatedly until they find a hash beginning with a required number of leading zeros. SHA-256 was chosen for its security, standardisation, and hardware acceleration availability.

Does uppercase vs lowercase matter for a hash?

For input: yes — "Hello" and "hello" produce completely different hashes. For output: no — "a3f2..." and "A3F2..." are the same value; upper/lowercase are just display preferences.

Is my data private when I use this tool?

Yes, completely. All hashing runs in your browser using the built-in Web Crypto API. No text you enter and no file you select is ever transmitted to any server. NerdyTools has no visibility into what you hash.