Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text instantly, in hex and Base64, or enter a key to get the HMAC for each. Everything is computed right in your browser — nothing you type is uploaded.
No hashes yet
Enter some text to generate all hashes instantly.
Frequently asked questions
How do I generate an MD5 or SHA-256 hash of some text?
Type or paste the text into the input box. Every supported digest — MD5, SHA-1, SHA-256, SHA-384 and SHA-512 — is computed as you type and shown together, in hex and in Base64, so you do not have to pick an algorithm first or run the text through five separate tools.
Can a hash be reversed or decrypted?
No. Hashing is one-way by design: the digest is a fixed-length fingerprint, not an encrypted copy, and the original text cannot be recovered from it. What people call "decrypting" a hash is really looking it up in a table of pre-computed hashes of common inputs, which only works when the input was short or predictable.
Which should I use, SHA-256 or SHA-512?
SHA-256 for almost everything: it is the default across TLS certificates, Git object IDs, blockchain protocols and file checksums, and 256 bits is far beyond any feasible brute-force attack. SHA-512 is not meaningfully more secure in practice, though it is faster on 64-bit hardware, so it shows up where large volumes are hashed.
Are MD5 and SHA-1 still safe to use?
Not for anything security-critical. Both are broken against collision attacks — two different inputs can be engineered to produce the same digest — so neither should back a signature, a certificate or a tamper check. They are still perfectly useful as fast non-cryptographic checksums, for spotting an accidentally corrupted download or keying a cache.
What is an HMAC, and when should I use one instead of a plain hash?
An HMAC is a hash keyed with a secret, defined in RFC 2104: the key is mixed into the input twice, so only someone who holds it can produce or check the value. Use it to authenticate messages — webhook signatures, signed API requests, session cookies — where a plain hash would let anyone recompute the digest after altering the message. Enter a key above and every algorithm switches to its HMAC form, with the key read as UTF-8 text. HMAC-MD5 is included because legacy APIs still require it; new designs should use HMAC-SHA-256.
Can I use these hashes to store passwords?
No, and this is a common and costly mistake. MD5 and the SHA family are built to be fast, which is exactly wrong for passwords: a modern GPU tries billions of candidates a second against them. Use a deliberately slow password hash with a per-user salt — Argon2id, scrypt or bcrypt — which is what every current guideline calls for.
Why does the same text always give the same hash?
That is the point of a hash: it is deterministic, so the same input produces the same digest on any machine, in any language, forever. It is what lets you verify a download by comparing a checksum, and it is also why passwords need a random salt added before hashing — without one, identical passwords hash identically and stand out.
Is the text I hash uploaded anywhere?
No. The whole tool is JavaScript running in your own browser, so nothing you type or paste is sent over the network, written to a log or attached to an analytics event. You can confirm it by opening the network tab and watching it stay empty while you work.