Hash Generator — MD5, SHA-256, SHA-512 and More

Our free hash generator computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any text or file instantly. Hash text in real time, upload files to verify their integrity, use HMAC mode for keyed hashing, and compare hashes to confirm a match. Everything runs in your browser using the Web Crypto API — no data is ever sent to a server.

What Is a Hash?

A cryptographic hash is a fixed-size fingerprint produced from any input by a hash function. No matter how long the input — a single character, a sentence, or a 10GB file — the hash output is always the same length for a given algorithm. SHA-256 always produces a 64-character hex string. MD5 always produces a 32-character hex string.

Hash functions have three key properties. First, they are deterministic — the same input always produces the same hash. Second, they are one-way — it is computationally infeasible to reverse a hash and recover the original input. Third, they are sensitive to change — even a single character difference in the input produces a completely different hash.

Hash Algorithm Comparison

Common Uses for Hashing

File Integrity Verification

When you download software, ISO files, or other large files from the internet, the source often provides an expected hash (usually SHA-256 or MD5). After downloading, you calculate the hash of your local file and compare it to the expected value. A match confirms the file downloaded completely and without corruption or tampering.

Password Storage

Websites should never store passwords in plain text. Instead they hash passwords before storing them. When you log in, the entered password is hashed and compared to the stored hash. Modern password storage uses slow hash functions like bcrypt, Argon2, or scrypt rather than MD5 or SHA — which are too fast and vulnerable to brute force attacks when used for passwords.

Digital Signatures and Certificates

HTTPS certificates, code signing, and document signatures use hash functions as part of the signing process. The hash of the content is computed, then the hash is signed with a private key. Recipients verify the signature by computing the hash themselves and checking it against the decrypted signature.

Data Deduplication

Storage systems like Dropbox, Git, and backup software use content hashing to detect duplicate files and data blocks. If two files have the same SHA-256 hash they are identical, so only one copy needs to be stored. Git uses SHA hashes to identify every commit, file, and tree in a repository.

API Authentication with HMAC

Many APIs use HMAC (Hash-based Message Authentication Code) to authenticate requests. The client combines the request data with a shared secret key and computes an HMAC-SHA-256 hash. The server recomputes the same HMAC using the same key and compares — if they match, the request is authentic. AWS, Stripe, GitHub webhooks, and many other services use HMAC-SHA-256 for request signing.

Why MD5 Is No Longer Secure

MD5 was designed in 1991 and is now considered cryptographically broken for security-sensitive applications. Researchers have demonstrated practical collision attacks — the ability to deliberately create two different inputs that produce the same MD5 hash. This means MD5 cannot be trusted for security purposes like password hashing, certificate signing, or tamper detection.

MD5 is still useful for non-security purposes like checksums, cache keys, and deduplication where collision resistance is not critical. For any security-sensitive use, always use SHA-256 or higher.

SHA-2 vs SHA-3