Which hash algorithm should I use?

SHA-256 for almost everything — it's the modern standard. SHA-512 when a spec demands it or for extra margin. SHA-1 only to interoperate with legacy systems that already use it.

Why is MD5 not offered?

MD5 has been cryptographically broken since 2004 — collisions can be manufactured cheaply. Offering it invites unsafe use; systems still requiring MD5 should be migrated.

Can I hash passwords with this?

Not for storage. Plain hashes are crackable at billions of guesses per second. Password storage needs a salted, deliberately slow function like bcrypt, scrypt or Argon2.

Is the same input guaranteed to give the same hash?

Yes — that's the defining property. The digest depends only on the exact bytes of input, so watch out for invisible differences like trailing newlines or different line endings.

Hash Generator

Compute SHA-1, SHA-256 and SHA-512 hashes of any text.

About the Hash Generator

A cryptographic hash is a fixed-length fingerprint of data: feed in any text and you get a digest — 64 hex characters for SHA-256 — that changes completely if even one character of the input changes, and can't be reversed back into the original. That one-way fingerprint property powers file-integrity checks, cache keys, deduplication, content addressing in git, checksums on download pages, and (with proper salting and stretching) password storage.

This tool computes SHA-1, SHA-256 and SHA-512 using the Web Crypto API built into your browser — the same audited implementation your browser uses for TLS, not a JavaScript re-implementation. Tick the algorithms you want, paste the text, and copy each hex digest with one click. Everything stays on your device: pasting a config file or an API payload here doesn't send it anywhere, which is the whole point when you're comparing checksums of sensitive material.

Choosing an algorithm: SHA-256 is the modern default — fast, universally supported, no known practical attacks. SHA-512 offers a longer digest and is often faster on 64-bit hardware; use it when a system asks for it. SHA-1 is included because legacy systems still reference it (git object IDs, older checksums), but it's cryptographically broken for collision resistance — verify against it when you must, never design with it. MD5 is deliberately absent: it's been thoroughly broken for decades, and offering it invites misuse. And remember hashing alone is not how passwords should be stored — that job needs salts and a slow KDF like bcrypt or Argon2.

Frequently asked questions

Which hash algorithm should I use?: SHA-256 for almost everything — it's the modern standard. SHA-512 when a spec demands it or for extra margin. SHA-1 only to interoperate with legacy systems that already use it.
Why is MD5 not offered?: MD5 has been cryptographically broken since 2004 — collisions can be manufactured cheaply. Offering it invites unsafe use; systems still requiring MD5 should be migrated.
Can I hash passwords with this?: Not for storage. Plain hashes are crackable at billions of guesses per second. Password storage needs a salted, deliberately slow function like bcrypt, scrypt or Argon2.
Is the same input guaranteed to give the same hash?: Yes — that's the defining property. The digest depends only on the exact bytes of input, so watch out for invisible differences like trailing newlines or different line endings.

Related tools

Password Generator

Create strong random passwords with cryptographically secure randomness.

UUID Generator

Generate one or a hundred random v4 UUIDs with one click.

Base64 Encoder / Decoder

Convert text to base64 and back — Unicode-safe, in your browser.

JWT Decoder

Decode a JSON Web Token and inspect its header, payload and expiry.

More developer & web utilities

QR Code Generator URL Encoder / Decoder Base64 Encoder / Decoder UUID Generator Regex Tester Color Converter CSS Gradient Generator HTML Entity Encoder / Decoder JWT Decoder Markdown to HTML Converter Timestamp Converter