Toolkit
← All tools

Hash generator

MD5, SHA-1, SHA-256 and SHA-512 of any text. Updates as you type

How to use the hash generator

  1. Type or paste any text — all four digests (MD5, SHA-1, SHA-256, SHA-512) update live on every keystroke. The box starts with “hello” so you can see the format immediately.
  2. Read the results as lowercase hex: MD5 is 32 characters (128 bits), SHA-1 is 40, SHA-256 is 64 and SHA-512 is 128.
  3. Click Copy next to the algorithm you need.
  4. Edit one character and watch every hash change completely — that's the avalanche effect, and it's why a hash works as a fingerprint.
  5. Text is hashed as its UTF-8 bytes, so accents and emoji hash exactly as a server would see them.

Common uses

  • Generate an expected value for a unit test or verify what a webhook signature should be when an API asks for “the SHA-256 of the payload”.
  • Fingerprint a string for a cache key, ETag or content-addressed filename — same input, same hash, on any platform.
  • Check whether two blocks of text are exactly identical: hash both and compare 64 hex characters instead of proofreading.
  • Match a value against a legacy system that stores MD5 or SHA-1 fingerprints.
  • Demonstrate hashing to a student or teammate — the live update makes the one-way, avalanche behavior obvious.

Tips & limitations

  • Hashes cover the exact bytes: a trailing newline, a curly quote instead of a straight one, or CRLF vs LF line endings each produce a completely different digest. If a hash “should” match and doesn't, hunt for invisible characters first.
  • Hashing is not encryption — there's nothing to decrypt, and anyone hashing the same input gets the same output. To make text unreadable without a key, use the text encryptor instead.
  • Treat MD5 and SHA-1 as legacy: both have known collision attacks, so use them only to interoperate with systems that already expect them. Default to SHA-256.
  • Text only — for hashing a file, use the file checksum tool, which reads the file's raw bytes rather than pasted text.
  • The SHA family needs a secure context (HTTPS) because it runs on the browser's Web Crypto API; MD5 is plain JavaScript and works regardless.

How it's built & why it's safe

SHA-1, SHA-256 and SHA-512 are computed by the browser's native crypto.subtle.digest() — the Web Crypto API, the same primitives the browser itself uses for TLS-era plumbing. MD5 isn't in Web Crypto, so it comes from a small bundled JavaScript implementation (the blueimp MD5 core) served from this site. Your text is encoded to UTF-8 with TextEncoder and hashed on your device on every keystroke; nothing you type is stored or sent anywhere, which matters when the thing you're fingerprinting is an API key or token.

Related tools: File Checksum · Text Encryptor · Base64 Encoder / Decoder

Further reading: Checksums: how to verify a downloaded file is genuine · Why Toolkit runs entirely in your browser (and why that matters)

Frequently asked questions

What is a hash, in plain terms?

A fixed-length fingerprint of any input: the same text always produces the same hash, and there's no way to run it backwards to recover the text. Even a one-character change produces a totally different fingerprint, which makes hashes ideal for comparing and indexing data.

Why does adding a single space change the whole hash?

That's the avalanche effect, a deliberate design property: every input bit influences every output bit. The tool hashes your text's exact UTF-8 bytes, so whitespace, line endings and invisible characters all count.

Can I reverse a hash to get the original text?

Not mathematically — hashing is one-way. But short or common inputs are guessable: attackers precompute hashes of millions of likely strings and look yours up. That's why a hash of a weak password protects nothing, even with SHA-512.

Which algorithm should I use?

SHA-256 is the sensible default — standard, fast and collision-resistant. Use MD5 or SHA-1 only when you must match a system that already uses them, and SHA-512 when a spec explicitly asks for it; it isn't automatically more secure in practice, just longer.

Should I hash passwords with this?

No. Plain MD5 or SHA hashes are far too fast for password storage — billions of guesses per second on a GPU. Real systems use deliberately slow, salted algorithms like bcrypt, scrypt or Argon2; this tool is for checksums, fingerprints and debugging.

Is my text sent anywhere?

No — every hash is computed locally in your browser, so it's safe to paste secrets like tokens or keys to fingerprint them. Closing the tab leaves no copy anywhere.