Hash Generator

Nothing leaves your device

The SHA family here is computed with the browser's native Web Crypto API, and MD5 with a small self-contained script. All of it runs locally — nothing you type is sent to a server, logged or stored.

What a hash actually is

A cryptographic hash turns any input, of any length, into a fixed-length "fingerprint". The same input always yields the same output, and changing a single character changes the result completely. It is a one-way function: you cannot work backwards from the fingerprint to the original. That makes hashes ideal for checking that two files are identical, spotting whether data has changed in transit, or indexing content.

Which algorithm should you use?

• MD5 and SHA-1 — fast and still everywhere, but broken against deliberate collision attacks. Use them only for non-security checksums, deduplication or cache keys, never for signatures or passwords.
• SHA-256 — the sensible default for integrity checks and fingerprints. Widely supported and with no practical weaknesses.
• SHA-384 and SHA-512 — longer digests for when you want extra margin; SHA-512 can be faster than SHA-256 on 64-bit hardware.

Checking a file

Use Hash a file instead to verify a download against the checksum a publisher lists. The SHA hashes are produced by the browser's native crypto and handle large files comfortably; MD5 is computed in JavaScript, so it is skipped automatically for files over 32 MB to keep the page responsive. Pasted text is capped at 1 MB for the same reason — use the file option for anything larger.

A hash is not encryption

Encryption is reversible with a key; hashing is not reversible at all. But "irreversible" does not mean "secret". Because anyone can hash a guess and compare, low-entropy inputs such as short passwords can be recovered from precomputed tables. Protecting passwords needs a deliberately slow, salted algorithm like bcrypt, scrypt or Argon2 — a bare SHA-256 is not enough.

Frequently asked questions

Is my text sent anywhere to be hashed?

No. SHA hashes are produced by your browser's built-in Web Crypto API and the MD5 hash by a small local script. Everything is computed on your device; nothing you type is transmitted, logged or stored.

Is MD5 still safe to use?

Not for security. MD5 and SHA-1 are broken against deliberate collision attacks and must not be used for signatures, passwords or anything trust-related. They remain fine for non-adversarial checksums, deduplication and cache keys, which is why they are included here.

Can a hash be reversed back to the original text?

No. Hashing is one-way by design. However, hashes are not secret: a short or common input can be found by comparing against precomputed tables, so hashing alone does not protect low-entropy data like passwords.

Why do the hashes appear instantly?

Because the work happens locally in your browser. Hashing a short piece of text is near-instant on modern hardware, and no network round-trip is involved.