"category": "dev-utility",
Hash Generator
"tldr": Type or paste text and see its MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes live - computed in your browser, nothing transmitted.
Compute five digests at once - MD5, SHA-1, SHA-256, SHA-384, SHA-512 - live as you type, each with a copy button. The SHA family runs on the browser's native WebCrypto; nothing you paste is ever transmitted, which matters because the things people hash are often the things they should not share.
Know what each is for in 2026: SHA-256 is the default for integrity checks and content addressing; MD5 and SHA-1 are cryptographically broken (collisions are practical) and survive only for legacy checksums and cache keys. And none of these - fast hashes all - are correct for passwords; that job belongs to bcrypt, scrypt, or Argon2.
How to generate hashes
- 1Type or paste text - all five digests update live.
- 2Click the copy icon next to the one you need.
- 3Hashes are of the exact UTF-8 bytes of your input - a trailing space changes everything.
- 4Verifying a file checksum? Hash locally with your OS tools (see snippets) - browsers are for strings.
Convert Text to Hashes in code
const data = new TextEncoder().encode(text);
const digest = await crypto.subtle.digest("SHA-256", data);
const hex = [...new Uint8Array(digest)]
.map(b => b.toString(16).padStart(2, "0")).join("");sha256sum file.tar.gz # Linux
shasum -a 256 file.tar.gz # macOSFrequently asked questions
The hash does not match the expected value - why?
Byte-level differences that eyes miss: a trailing newline or space, CRLF vs LF line endings, different unicode normalization (é as one codepoint vs e+combining accent), or a BOM. Hash functions amplify one different byte into a completely different digest - that is their job.
Is MD5 really unusable?
For anything security-relevant, yes - collisions can be manufactured on a laptop, so signatures, certificates, and dedupe of untrusted content are all attackable. It remains acceptable for non-adversarial uses: cache keys, quick change-detection of your own files, legacy protocol compatibility.
Why not use these for passwords?
Because they are fast - a GPU tries billions of SHA-256 candidates per second against a leaked database. Password storage needs deliberately slow, salted, memory-hard functions: Argon2id (preferred), bcrypt, or scrypt. Fast hashes are for integrity, not secrets.
Last updated:
You might also need
Free and in-browser, like everything on JSON Console. Browse all tools →