Hash Generator — MD5, SHA-1, SHA-256 Online
Compute MD5, SHA-1, SHA-256, SHA-384, SHA-512 of any text or file. All hashing happens in your browser.
Input
Notes
- MD5 and SHA-1 are cryptographically broken — use SHA-256 or SHA-512 for new systems.
- All processing uses the browser's
SubtleCryptoAPI (SHA) and a bundled MD5 implementation. - Nothing is uploaded.
About Hash Generator
A hash function maps data of any size to a fixed-length digest, and it is one-way: you cannot recover the original input from its output. This tool computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests so you can compare files, verify downloads, or check data integrity. SHA-256 and SHA-512 are the current cryptographic standards, while MD5 and SHA-1 are considered broken for security-sensitive uses.
Use a hash when you need integrity verification — for example, confirming that a downloaded file matches its published checksum. Never rely on MD5 or SHA-1 to protect passwords or sign data, and choose SHA-256 or SHA-512 for any new system. Note that a hash proves data was not accidentally corrupted, but it does not authenticate who the data came from.
One pass, every digest, no key
This page is the unkeyed view. It takes one input and produces every digest of those exact bytes at once — MD5, SHA-1, SHA-256, SHA-384 and SHA-512 — with optional hex and Base64 formatting, and it accepts a local file as the input source. Nothing is keyed and nothing is uploaded. Producing all five in one pass is the practical reason to prefer it when checking an integrity manifest: the digests must all come from the same bytes, and hashing the file five times separately invites a mismatch if it changes between reads.
The four SHA digests come straight from `crypto.subtle.digest`, which is non-incremental and one-shot; SHA-1 and SHA-2 are implemented by every modern browser engine, which is why they need no bundled code. Hex and base64 output can be shown together, hex lowercase. That case detail is not cosmetic when you are string-matching a digest against a reference — half the world's manifests use uppercase hex.
Text and files are hashed differently
Typed text is encoded with `TextEncoder`, so you get the UTF-8 bytes of that exact string; an uploaded file is read with `arrayBuffer()` and hashed as raw bytes, with no normalisation in either direction. This is the distinction behind most —why are these two files different— moments: a trailing newline, a BOM, or a tab versus spaces are all part of the input, and every one of them changes the digest completely.
The practical consequence is that a checksum is only reproducible if the byte sequence is pinned. If you are hashing structured data to detect unauthorised edits, hash a canonical serialisation — sorted keys, fixed separators, no incidental whitespace — or the pretty-printed form will produce a different value on every reformat, and the check becomes noise. The avalanche effect is the flip side of the same property: change one character anywhere and every output bit is equally likely to flip.
Where this page stops
There is one difference between this page and the hash-generator, and it concerns only MD5. SubtleCrypto does not implement MD5, so that digest comes from a bundled pure-JavaScript implementation of RFC 1321 rather than the browser's own. It runs over the same bytes as the SHA family, so the MD5 row is a real digest of your input — which matters when you are matching a checksum that a legacy system published. The other four rows go straight through SubtleCrypto, which is constant-time by design and considerably faster for large inputs.
A plain digest proves nothing about origin, because anyone can recompute it. Tamper-evidence needs a keyed construction or a signature; a password store needs a deliberately slow, salted function. And no fast digest belongs in a credential path regardless of how it is obtained — use this page for content fingerprinting, cache keys, deduplication and verifying downloads, and choose the tool that matches the job.
Next steps
- HMAC Generator— sign a message with this hash
- File Checksum— hash entire files
Frequently Asked Questions
How do I hash a string?
Is hashing reversible?
Is my data sent to a server?
Do I need an account or API key?
Can I use these tools offline?
All processing happens in your browser. No uploads, no tracking, no servers. Your API keys, configs, and private payloads stay private — 100% client-side.