Hash Generator

Overview

A hash function produces a fixed-length fingerprint (digest) from input data. Changing even one character in the input changes the hash. This tool computes MD5, SHA-1, SHA-256, and SHA-512 hashes from text you paste. Hashes are one-way: you cannot recover the original data from the hash. They are used for checksums, integrity verification, and in security (e.g. password hashing with salt—though MD5 and SHA-1 are not recommended for new password systems). Use the Base64 tool for reversible encoding; use the Password Generator for generating random secrets.

Each algorithm produces a different length: MD5 (32 hex), SHA-1 (40), SHA-256 (64), SHA-512 (128). SHA-256 and SHA-512 are preferred for new applications.

When to use it

Use the Hash Generator when you need to verify file or text integrity (compare hashes before and after transfer), when debugging API signatures or checksums, or when you need a short fingerprint of a string for caching or deduplication. For password storage, use proper password-hashing libraries (e.g. bcrypt, Argon2), not raw MD5 or SHA-1. For encoding (reversible), use Base64 or URL Encode/Decode. For JWTs, use the JWT Decoder to inspect payloads; the signature is a hash but verification requires the key.

How to use it

Paste your text into the input area. Optionally enable "Trim whitespace" or "Normalize line endings" so the hash matches what you expect from other tools or scripts. Click Generate. The tool outputs MD5, SHA-1, SHA-256, and SHA-512 in a table; each row has a copy button. Copy the value you need. Clear clears input and output. Input is processed in your session; we do not store or log the content. For very long text, some browsers may slow down; the tool is intended for normal-sized inputs.

Tips

Use SHA-256 or SHA-512 for new integrity or security use cases; MD5 and SHA-1 are considered weak for cryptographic purposes. Always compare hashes in constant time to avoid timing attacks when checking secrets. For file hashes, ensure the file is read in binary mode and no BOM or line-ending conversion is applied. The JWT Decoder shows the decoded header and payload of a JWT; the signature part is base64url-encoded and is a hash of the token contents.

Common mistakes

Using MD5 or SHA-1 for password hashing without salt is insecure; use dedicated password-hashing functions. Comparing hashes with a simple string equality can leak information via timing; use a constant-time comparison. Assuming two different inputs cannot have the same hash (collision) is wrong—collisions exist but are rare for SHA-256+. For encoding (need to decode later), do not use hashes; use Base64. Do not put sensitive data into online tools if your policy forbids it; this tool runs in your session and we do not store input.