RunToolRunHash Generator
Generate MD5, SHA-1, SHA-256 hashes.
How to Generate Hash Values
Paste your text
Enter any string — a password to check, file contents, an API payload.
Hashes are computed locally
MD5, SHA-1, SHA-256 and SHA-512 digests are generated in your browser.
Copy the hash you need
Each algorithm's output is one click away.
A hash is a one-way fingerprint
A hash function turns input of any length into a fixed-length value. The same input always produces the same hash; changing a single bit produces a completely different one. Crucially, the process cannot be reversed — the hash contains no recoverable copy of the input.
That property is what makes hashing useful for verification rather than storage. You cannot get a file back from its hash, but you can prove that a file you already have is the same one that produced it.
What SHA-1 is still good for, and what it is not
SHA-1 is offered here because it remains in wide use for non-adversarial purposes — Git object identifiers, legacy checksums, matching against systems that still emit it. For detecting accidental corruption it works perfectly well.
It is broken for anything where an attacker is involved. Practical collisions have been demonstrated, meaning two different files can be constructed with the same SHA-1. For signatures, certificates or anything security-relevant, use SHA-256 or above. MD5 is not offered at all, because it is broken more thoroughly still and there is no responsible reason to generate one today.
Hashing is not how passwords should be stored
A plain SHA-256 of a password is fast to compute, which is exactly the wrong property. Modern hardware tries billions of candidates per second, so a fast hash of a common password is recovered almost instantly from a precomputed table.
Password storage needs a deliberately slow algorithm designed for the purpose — bcrypt, scrypt or Argon2 — with a unique random salt per password. If you are building authentication, none of the algorithms here are the right tool, and that is a property of general-purpose hashes rather than a limitation of this page.
Verifying files and text
The everyday use is integrity checking. A download that publishes a SHA-256 lets you confirm the file arrived intact and unmodified — compare the two strings and either they match exactly or the file is not the one that was published.
For that check to mean anything, the published hash must come from a source you trust and a different channel from the file itself. A hash listed on the same page as a compromised download proves nothing at all.
How it runs here
Hashing uses the browser's built-in Web Crypto implementation, which is the same audited code the browser uses for its own security operations rather than a hand-written version. All four digests are computed on your device.
Nothing is uploaded, which matters more than it sounds: people routinely paste passwords, tokens and confidential text into hash tools, and a server-side one receives all of it in the clear before hashing anything.