Type any text to see its MD5, SHA-1, SHA-256, and SHA-512 hashes, computed instantly and locally.
Runs entirely in your browser — nothing you type here is sent to our server.
Hashing shows up in a surprising number of everyday systems. Software downloads are often published alongside a SHA-256 checksum so you can confirm the file you downloaded wasn't corrupted or tampered with in transit — you hash the file yourself and check it matches. Git, the version control system, identifies every commit by a hash of its contents. Databases use hashes to quickly detect duplicate records without comparing entire fields character by character. And well-built login systems never store your actual password — they store a hash of it (combined with additional safeguards like a per-user salt), so that even if the database were ever exposed, the original passwords wouldn't be directly readable.
The reason hashing works for all of these is a property called determinism combined with practical irreversibility: the same input always produces the same fixed-length output, a tiny change to the input produces a completely different output, and there's no practical way to work backwards from the output to the input. MD5 and SHA-1 still satisfy the first two properties, which is why they remain fine for things like detecting accidental file corruption, but researchers have found ways to deliberately construct two different inputs that collide on the same MD5 or SHA-1 output, which breaks the guarantees needed for security-sensitive use. SHA-256 and SHA-512 have no such known weakness, which is why they've become the standard for anything where security actually matters.
Written from what each site tells us about itself and how the directory works — see something off? Let us know.
A hash function takes any input — a word, a password, an entire file's worth of text — and produces a fixed-length string of characters that acts like a fingerprint for that exact input. Change even a single character of the input and the hash comes out completely different. The same input always produces the same hash, but you can't practically work backwards from a hash to recover the original input.
They're different hashing algorithms, mainly differing in output length and cryptographic strength. MD5 (128-bit output) and SHA-1 (160-bit output) are older and now considered cryptographically broken for security purposes — researchers have demonstrated practical ways to engineer two different inputs with the same hash (called a collision) — though both remain common for non-security uses like checking file integrity against accidental corruption. SHA-256 (256-bit) and SHA-512 (512-bit) are part of the newer SHA-2 family and have no known practical collision attacks, which is why they're the standard choice today for anything security-sensitive, including storing password hashes and verifying software downloads.
The Web Crypto API (crypto.subtle.digest) is built directly into modern browsers and implements the SHA algorithms natively, in optimized code, without needing to load any external library. MD5 is deliberately excluded from the Web Crypto API by browser makers, since it's considered broken for the security purposes that API is designed for — so this tool includes a small, separately vendored MD5 implementation just for that one algorithm.
The hashing itself happens entirely in your browser and is never transmitted anywhere, so typing text here is no less private than typing it into any other text box in your browser. That said, a hash generator is a learning and file-verification tool, not a substitute for how a real system should store passwords, which involves additional techniques (like salting and deliberately slow algorithms) beyond a single plain hash.
You can verify text this way, but this tool takes typed or pasted text as input, not a file directly. If a download page publishes a SHA-256 checksum for a file, you'd compare it against a hash computed from the file's actual bytes using a file-hashing utility on your computer, not by pasting text here.
