Generate MD5, SHA1, SHA256, SHA512 hashes from any text.
The Hash Generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text or file, and can also produce HMACs with a secret key. Results update as you type, and everything is calculated in your browser, so the text or file is never uploaded.
Made for developers. Typical uses:
Generating a SHA-256 hash for the string "invoice-2024-001" produces a fixed 64-character hexadecimal fingerprint. Changing just one character — to "invoice-2024-002" — produces a completely different 64-character result with no visible resemblance to the first, even though only one digit changed. That unpredictable, all-or-nothing change (the avalanche effect) is what makes hashes reliable for spotting even a single-character edit to a file or message.
MD5 and SHA-1 are fine for checksums but are broken for security use, and plain hashes should never be used to store passwords. Files up to 200 MB are supported.
Accuracy: Output is tested against known inputs. For production code, review the result and run your own tests.
Expert Tip
For file integrity checks, prefer SHA256 over MD5 or SHA1 — both are considered cryptographically broken for security purposes, even though they're still fine for basic non-security checksums like spotting accidental corruption.
A hash function turns any input into a fixed-length fingerprint. The same input always gives the same hash, a tiny change gives a completely different one, and the original cannot be recovered from the hash. The Hash Generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text or for a file of up to 200 MB, and it can also compute an HMAC with a secret key.
The word hello gives these hashes, which you can use to confirm that any tool you use is working.
The most common use is checking that a file arrived intact. Publishers list a checksum next to a download. Choose the file in the tool, compute SHA-256 and compare the result with the published value, character by character. If they match, the file was not corrupted or changed on the way. Prefer SHA-256 or SHA-512 for this; if a site only offers MD5 or SHA-1, they still catch accidental damage but are not safe against someone who deliberately crafts a file.
An HMAC mixes a secret key into the hash, so only someone who knows the key can produce or check it. APIs use it to sign requests and webhooks. Tick HMAC with a secret key, type the key, and the tool computes the keyed hash: the HMAC-SHA-256 of hello with the key secret is 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b. There is also an option to show the hexadecimal output in uppercase.
A plain hash is not a safe way to store passwords, because fast hashes can be tested against billions of guesses per second. Passwords need a deliberately slow, salted algorithm such as bcrypt or Argon2. MD5 and SHA-1 are broken for security purposes. Base64, hashing and encryption: what is the difference? explains the three ideas, and the Password Generator creates strong passwords. The work is done in your browser using its built-in cryptography, so files and text are never uploaded.
Use SHA-256 as the sensible default. SHA-384 and SHA-512 are longer and are chosen by some standards and for speed on 64-bit machines. MD5 and SHA-1 remain in use for quick checksums, cache keys and legacy systems, but a determined attacker can create two different files with the same MD5 or SHA-1 hash, so they must not protect anything. For more on picking a method and on passwords, see the Password Strength Checker and the guide to password strength: length vs complexity.
Base64 is not encryption and a hash cannot be reversed. See what each does, where JWTs and URL encoding fit, and how to pick MD5, SHA-256 or a password hash.
Explore more in Developer Tools, read the guides and articles, or see how we test our tools.
Encode text and data to Base32 format.
Best for generating or inspecting a Base32-encoded TOTP secret key for two-factor authentication setup
Encode and decode Base64 strings instantly.
Best for encoding binary data for email and web transmission
Check color contrast ratios for WCAG compliance.
Best for checking that body text color meets WCAG AA contrast requirements before shipping a website
Parse and understand cron expressions with human-readable descriptions.
Best for confirming a scheduled job in a server crontab actually runs when you think it does before deploying it
Convert external CSS to inline styles for HTML emails.
Best for converting a designed HTML email template into inline-styled markup before sending a campaign
Format and beautify messy CSS code with proper indentation.
Best for beautifying minified CSS for editing
Generate strong, secure passwords with customizable length and character types.
Best for creating strong passwords for new accounts
Check how strong your password is. Instant analysis with improvement tips.
Best for checking a new account password before submitting a signup form