Hash Generator
The SHA-256, SHA-512, SHA-1 or MD5 hash of any text, in hex, capitals and Base64, worked out in your browser.
Results
What this tool does
A hash turns any amount of text into a fixed-length fingerprint: change one character anywhere and the result changes completely. That is what makes it useful for checking a download arrived intact, for telling whether two files are the same without reading both, and for the version tags on a cached file. All four algorithms run here in the page — nothing is uploaded, which matters because the things worth hashing are rarely things worth sending away.
Formula
MD5 (RFC 1321), SHA-1, SHA-256 and SHA-512 (FIPS 180-4), over the text encoded in UTF-8
Variables
| Symbol | Meaning | Unit |
|---|---|---|
text | Your text | — |
algorithm | Algorithm | — |
OUT | The hash | — |
UP | In capitals | — |
B6 | In Base64 | — |
SH | First eight characters | — |
AL | Algorithm | — |
BI | Length in bits | — |
IB | Bytes that went in | — |
SE | Safe for security work | — |
Worked example
- Your textThe quick brown fox jumps over the lazy dog
- Algorithmsha256
- The hashd7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
- In capitalsD7A8FBB307D7809469CA9ABCB0082E4F8D5651E46D3CDB762D02D0BF37C9E592
- In Base6416j7swfXgJRpypq8sAguT41WUeRtPNt2LQLQvzfJ5ZI=
- First eight charactersd7a8fbb3
- AlgorithmSHA-256
- Length in bits256
- Bytes that went in43
- Safe for security workYes
Limitations
- The calculation runs entirely in your browser. The values you type are never sent to a server.
Frequently asked questions
Why are MD5 and SHA-1 marked as broken?
Because both have been shown to allow collisions: two different inputs that produce the same hash, constructed on purpose. MD5 fell in 2004 and SHA-1 in 2017, when researchers produced two PDF files with the same SHA-1. That destroys them for signatures, certificates and anything where someone might want to substitute one file for another. It does not affect their use as a checksum against accidental corruption, which is why they are still here.
Can I use this to store passwords?
No. A plain hash of a password, even SHA-512, can be tested at billions of guesses a second on ordinary hardware, which is exactly what makes a stolen database worth stealing. Passwords need a function built to be slow and to use a per-password salt — bcrypt, scrypt or Argon2. This page is for checksums, fingerprints and comparing whether two things are identical, not for authentication.
Is the text sent anywhere to be hashed?
No. All four algorithms are written into the page and run in your own browser, which for this tool in particular is the only acceptable arrangement — the things people hash are the things they would least like to send to a stranger. You can switch the network off and it will keep working.