Hash Generator
Hash text or a file with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once. Everything runs locally — your input never leaves the browser.
43 B of UTF-8 text.
…Collisions are trivial to produce. Fine for checksums, never for passwords or signatures.
…Practical collisions exist. Kept for legacy systems only.
…Safe for integrity checks and signatures. Passwords need a slow KDF such as bcrypt or Argon2.
…Safe for integrity checks and signatures. Passwords need a slow KDF such as bcrypt or Argon2.
…Safe for integrity checks and signatures. Passwords need a slow KDF such as bcrypt or Argon2.
What the Hash Generator does
- Computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at the same time, from text or a file.
- Reads files entirely in your browser, so nothing is uploaded.
- Labels each algorithm as broken, weak or strong, with the reason.
- Outputs lowercase hexadecimal, the form checksums are normally published in.
What it doesn't do
- It doesn't reverse or crack hashes — hashing is one-way by design.
- It doesn't salt, and it isn't a password hashing function.
- It doesn't compute HMACs or other keyed digests.
Frequently asked questions
Can a hash be decrypted back to the original?
No. Hashing is one-way: it destroys information deliberately. Sites claiming to "decrypt" a hash are looking it up in a table of pre-computed common inputs, which is exactly why unsalted password hashes are unsafe.
Should I use MD5?
Only for non-security checks such as verifying a file downloaded intact. Collisions can be produced deliberately in seconds, so MD5 must never be used for passwords, signatures or anything an attacker could benefit from forging. Use SHA-256 instead.
Can I hash a password with this?
You can, but you shouldn't use the result to store one. Fast hashes are the wrong tool for passwords precisely because they're fast — an attacker can try billions per second. Use a deliberately slow function such as bcrypt, scrypt or Argon2.
How do I check a downloaded file's checksum?
Drop the file into the File tab and compare the SHA-256 value with the one published by whoever distributed it. If they match character for character the file is intact; if they don't, don't run it. The file is read locally and never uploaded.