MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes — computed locally as you type.
What is a hash function?
A hash function turns any input — a password, a file, a message — into a fixed-length string of
characters called a hash or digest. The same input always produces the same hash, yet changing a
single letter produces a completely different one. Hashes are one-way: you cannot reconstruct the
original input from the digest, which makes them ideal for verifying data integrity and storing
password proofs.
How to use this tool
- Type or paste any text into the input box above.
- All five hashes — MD5, SHA-1, SHA-256, SHA-384 and SHA-512 — update instantly as you type.
- Toggle Uppercase hex if you need capital letters, as some systems expect.
- Click a Copy button to copy that hash to your clipboard.
Which algorithm should you choose?
- MD5: fast but cryptographically broken — use only for non-security checksums, such as detecting accidental file corruption.
- SHA-1: deprecated for security purposes; still common in Git and other legacy systems.
- SHA-256: the safe default today — used for file integrity checks, TLS certificates and blockchains.
- SHA-384 / SHA-512: longer digests with a bigger security margin; SHA-512 is often faster than SHA-256 on 64-bit systems.
Pick an algorithm
Need just one hash? Each algorithm has its own dedicated page:
Why does my hash not match another tool?
Hashes are computed over bytes, not characters, so two inputs that look identical can still produce different digests. The three usual causes:
- A trailing newline. The shell command
echo "secret" hashes "secret" plus a line break, while printf %s "secret" (or echo -n) hashes just the word. Text copied out of a terminal often carries that invisible newline.
- Character encoding. This tool encodes your input as UTF-8 before hashing. "café" is 5 bytes in UTF-8 but 4 bytes in Latin-1, so a tool using a different encoding returns a different digest for the same word. Make sure both sides use UTF-8.
- Stray whitespace. Leading or trailing spaces from copy-paste change the input — and therefore the hash. This tool hashes exactly what sits in the box, byte for byte.
Digest sizes at a glance
Every algorithm has a fixed output length, so a quick character count tells you whether a pasted hash is complete or truncated:
| Algorithm | Bits | Hex characters |
|---|
| MD5 | 128 | 32 |
| SHA-1 | 160 | 40 |
| SHA-256 | 256 | 64 |
| SHA-384 | 384 | 96 |
| SHA-512 | 512 | 128 |
Letter case is only display formatting: toggling Uppercase hex does not change the underlying value, and two digests that differ only by case are the same hash.
Frequently asked questions
Is MD5 secure?
No. MD5 is cryptographically broken: anyone can craft two different inputs with the same MD5 hash (a collision) in seconds on a normal computer. Never use it for passwords, digital signatures or certificates. It is still acceptable as a quick checksum against accidental corruption, but for anything security-related use SHA-256 or stronger.
Can a hash be reversed?
Not directly — hash functions are one-way by design, so there is no formula to turn a digest back into its input. However, short or common inputs can be recovered by brute force or rainbow tables: an attacker hashes millions of guesses until one matches. That is why passwords should be stored with a slow, salted key-derivation function such as bcrypt, scrypt or Argon2 instead of a plain fast hash.
Why is SHA-256 the standard for checksums?
SHA-256 offers the best balance: no practical collision attack has ever been found, it is fast on every modern device, and it is supported everywhere — from the Web Crypto API built into your browser to package managers and TLS certificates. Unless you have a specific reason to pick another algorithm, SHA-256 is the right default for verifying file integrity.
Is my text uploaded to a server?
No. Every hash is computed locally in your browser: SHA-1, SHA-256, SHA-384 and SHA-512 use the built-in Web Crypto API, and MD5 runs in a small JavaScript implementation embedded in this page. Nothing you type is ever sent over the network — you can even disconnect from the internet and the tool keeps working.