Hash Generator

A hash function takes any input — a word, a password, an entire file — and produces a fixed-length string of characters (the "hash" or "digest") that acts like a fingerprint of that input. Change even a single character in the input and the output hash changes completely and unpredictably; feed the same input in twice and you always get the same hash back. That combination of properties makes hashes useful for two quite different jobs: checking that data has not been altered (integrity checking) and, for certain specially-designed algorithms, storing secrets like passwords without keeping the original value anywhere. This tool supports five widely used algorithms. MD5 produces a 128-bit (32 hex character) digest and was, for many years, the default choice for quick checksums because it is fast and simple. SHA-1 produces a 160-bit (40 character) digest and was the mainstream successor to MD5 through the 2000s. SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family, producing 256-bit, 384-bit and 512-bit digests respectively, and are the current standard for anything where hash strength actually matters. A critical point up front: MD5 and SHA-1 are cryptographically broken. Researchers have demonstrated practical collision attacks against both — meaning it is possible to deliberately construct two different inputs that produce the identical hash, undermining any use case that relies on a hash being unique to its input. Google and CWI Amsterdam published a working SHA-1 collision ("SHAttered") in 2017, and MD5 collisions have been achievable on ordinary hardware since the mid-2000s. Neither algorithm should ever be used for password storage, digital signatures, certificate generation, or any other context where an attacker being able to forge a matching hash would cause real harm. This tool includes them anyway because they remain extremely common for legacy, non-adversarial purposes — verifying that a downloaded file was not corrupted in transit, generating a quick cache key, or comparing two local files for equality — where nobody is deliberately trying to produce a collision. For anything security-sensitive, use SHA-256 or stronger. Even then, hashing alone is the wrong tool for storing passwords: a plain SHA-256 hash of a password can still be brute-forced quickly with modern hardware because the algorithm is designed to be fast, which is exactly the wrong property for password storage. Proper password storage uses a deliberately slow, salted algorithm designed for that job specifically — bcrypt, scrypt, or Argon2 — not a general-purpose hash function like the ones in this tool. Use this generator for checksums, file-integrity verification against a known-good published hash, generating short unique identifiers from content, and similar non-adversarial tasks; do not use it to hash passwords, API secrets, or anything an attacker might try to reverse or collide.