Hash Generator
Generate cryptographic hashes from any text using MD5, SHA-1, SHA-256, and SHA-512 algorithms. All hashing is performed using the browser's native Web Crypto API — your input never leaves your device.
Hash Algorithm Comparison
MD5 (128-bit)
Fast but cryptographically broken. Still used for checksums and non-security file integrity checks. Not recommended for passwords or security.
SHA-1 (160-bit)
Deprecated for security use. Still found in legacy systems and Git commit IDs. Avoid for new security implementations.
SHA-256 (256-bit)
The current industry standard for security. Used in TLS certificates, Bitcoin, JWT signatures, and password hashing. Recommended for most use cases.
SHA-512 (512-bit)
Stronger than SHA-256 with a larger output. Used when maximum security is required. Slightly slower but more resistant to brute-force attacks.
Common Use Cases for Hash Generation
- File integrity verification — generate a hash of a file and compare it later to detect tampering
- Password storage — store SHA-256 or SHA-512 hashes of passwords instead of plain text (use bcrypt for production)
- API request signing — many APIs use HMAC-SHA256 to sign requests for authentication
- Data deduplication — hash records to quickly identify duplicates in large datasets
- Checksums — verify downloaded files match the expected hash provided by the publisher
- Cache keys — generate consistent cache keys from dynamic content
Important Security Notes
- MD5 and SHA-1 are not secure for cryptographic purposes — collisions have been demonstrated
- For password hashing, use bcrypt, scrypt, or Argon2 — not raw SHA-256
- Hashing is a one-way function — you cannot reverse a hash to get the original input
- This tool uses the browser's native
SubtleCryptoAPI — no server processing
Use Base64 encoding for reversible text encoding.
How Cryptographic Hash Functions Work
A cryptographic hash function takes an input of any size and produces a fixed-size output called a hash, digest, or checksum. Hash functions have three key properties that make them useful for security: they are deterministic (the same input always produces the same output), they are one-way (you cannot reverse a hash to get the original input), and they are collision-resistant (it is computationally infeasible to find two different inputs that produce the same hash). These properties make hash functions essential for password storage, data integrity verification, digital signatures, and blockchain technology.
Hash Algorithms in Real-World Applications
Password Storage
Databases store hashed passwords, not plain text. When a user logs in, the entered password is hashed and compared to the stored hash. Use bcrypt, scrypt, or Argon2 for passwords — not raw SHA-256.
File Integrity
Software publishers provide SHA-256 checksums for downloads. After downloading, hash the file and compare it to the published hash to verify the file was not corrupted or tampered with.
Digital Signatures
TLS certificates, code signing, and JWT signatures all use hash functions. The document is hashed, and the hash is signed with a private key. Verifiers hash the document and check the signature.
Git Version Control
Git uses SHA-1 (transitioning to SHA-256) to identify every commit, tree, and blob. Each commit hash uniquely identifies the exact state of the repository at that point in time.
Choosing the Right Hash Algorithm
The choice of hash algorithm depends on your use case and security requirements:
- MD5 — use only for non-security checksums and legacy compatibility. Cryptographically broken since 2004. Never use for passwords or security-sensitive data.
- SHA-1 — deprecated for security use since 2017. Still found in legacy systems and Git (being phased out). Avoid for new implementations.
- SHA-256 — the current standard for most security applications. Used in TLS 1.3, Bitcoin, JWT (HS256/RS256), and code signing. Recommended for general use.
- SHA-512 — provides stronger security than SHA-256 with a 512-bit output. Use when maximum security is required or when processing large amounts of data on 64-bit systems where it can be faster than SHA-256.
Related Tools
- JWT Decoder — JWT signatures use HMAC-SHA256 or RSA-SHA256 hashing
- Base64 Encoder — hash outputs are often Base64 or hex encoded
- Number Base Converter — convert hash hex values to decimal or binary
- URL Encoder — encode hash values for safe use in URLs
- Timestamp Converter — convert timestamps used in HMAC signing