Hash Generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text.
About this converter
Hashes the text you paste with any of five algorithms, or all of them at once.
SHA-1 through SHA-512 come from your browser's own cryptography, which is both faster and more trustworthy than anything a web page could ship. MD5 does not — no browser exposes it, precisely because it has been unfit for security purposes since the mid-2000s — so it is implemented here, because the reason people want MD5 is checking a download against a checksum somebody published, and that is a perfectly good use of a broken hash.
This is not how you store a password. A hash is fast by design, which is exactly wrong for passwords: a modern graphics card tries billions of SHA-256 guesses a second. Passwords need a slow, salted function built for the job — bcrypt, scrypt or Argon2 — and no amount of hashing here substitutes for one.
What this is good for: verifying a file or string is unchanged, generating a cache key, checking a checksum, and seeing what a given input produces.
Frequently asked questions
Which algorithm should I use?
SHA-256 unless something specific requires otherwise. It is fast, widely supported and has no known practical weakness. Use SHA-512 where a longer digest is wanted. Use SHA-1 and MD5 only to match a checksum someone else generated — never for anything where an attacker benefits from a collision.
Can I hash a password with this?
You can, but you should not store the result. Hashes are built to be fast, and that is the opposite of what password storage needs — commodity hardware tries billions of guesses per second against SHA-256. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted. This tool has no place in an authentication system.
Why is MD5 still here if it is broken?
Because "broken" means collisions can be constructed deliberately, not that it fails at detecting accidental corruption. Plenty of projects still publish MD5 checksums, and comparing one is a legitimate thing to want to do. It just must not be used where someone might be trying to fool you.
Can I hash a file rather than text?
Not yet — this takes pasted text. For a file, your operating system can do it directly: certutil -hashfile on Windows, shasum or md5 on macOS and Linux.
Why do I get a different hash than another tool?
Almost always a trailing newline. Hashing "abc" and "abc\n" gives completely different results, and a text editor may add one invisibly. Character encoding matters too — this hashes the UTF-8 bytes, which is what other tools mean by the text unless they say otherwise.
Does what I paste get sent anywhere?
No. The conversion runs in your browser, on your own machine — that is why the result appears as you type rather than after a wait. Nothing is uploaded, nothing is logged, and closing the tab is the end of it. This matters more here than on most pages: tokens, keys and internal data get pasted into tools like this constantly, and most of them are a form that posts to a server.