This generator turns whatever you type into a fixed-length fingerprint, computing MD5, SHA-1, SHA-256, and SHA-512 at the same time so you can compare all four without switching modes. A hash answers one question — "are these two pieces of content byte-for-byte identical?" — and it is not encryption: the operation is one-way, and nothing can turn a digest back into the original text. All four run inside your browser, so the input never leaves this machine.
How to use it
- Paste your text into the input box. There is no Generate button — every keystroke recomputes all four digests and the result cards update in place.
- The cards are always MD5, SHA-1, SHA-256, SHA-512, top to bottom, each showing the full lowercase hex digest (32, 40, 64, and 128 characters respectively).
- While a batch is computing, the cards grey out and show a progress label. When the text returns to its normal color, the values you see are final.
- Copy a single digest with the button in the top-right corner of its card. Each algorithm copies independently; there is no copy-all.
- An empty input box is not an error state — you are seeing the hash of the empty string:
d41d8cd98f00b204e9800998ecf8427efor MD5,e3b0c442…7852b855for SHA-256. Those two constants are a reliable sign the box is genuinely empty. - To hash something else, just overwrite the text. There is no clear button, and no history is kept.
When it comes in handy
Confirm two long strings are truly identical
Comparing two config blobs, two certificates, or the same announcement received through two channels by eye will miss a stray space or a full-width punctuation mark. Hash each one and compare the first and last eight characters of the SHA-256. Identical input always produces identical output, and a single changed bit rewrites the entire digest rather than a few characters — the avalanche effect.
Debug a third-party API signature
Payment gateways, SMS providers, and open platforms typically make you concatenate request parameters in a specified order and take md5() or sha256() of the result as a signature. Paste the documented example string here to get the expected value by hand, then diff it against what your code produces — that isolates whether the bug is ordering, a missing parameter, or character encoding.
Derive a stable cache key or content fingerprint
When you need a fixed-length key for a query string, a set of request parameters, or a template body, SHA-256 is the safe default: the same input always yields the same 64 characters, the length never grows with the input, and the output contains nothing that needs escaping.
Cross-check hashes stored in a legacy system
Databases from a decade ago routinely store MD5 or SHA-1 in a column. When you are verifying a migration script, hashing the original string here and comparing is the fastest check. That compatibility work is the only reason MD5 and SHA-1 are still offered here — not a recommendation to use them in anything new.
Limits and behavior
- A hash is a one-way digest, not encryption. There is no reverse button here, and no tool anywhere can genuinely "decrypt" a hash. Sites advertising MD5 decryption are looking up precomputed tables of common strings (rainbow tables): effective against
123456, useless against an arbitrary sentence. - This hashes text, not files. The string is UTF-8 encoded into bytes before hashing, so the result matches
md5sumrun on a file containing exactly those bytes with no trailing newline. When a digest here disagrees withsha256sum file.txt, a trailing\nin the file is the usual culprit. There is no file upload, so this cannot verify an ISO or an installer. - Line endings change the digest.
\r\n(Windows) and\n(Linux/macOS) are different bytes and hash differently. Worth knowing: per the HTML specification a textarea normalizes its value to LF, so even if you paste CRLF content out of Notepad, the digest you get here is the LF version. - MD5 and SHA-1 are broken in practice: MD5 collisions were constructed back in 2004, SHA-1 fell to the SHAttered collision in 2017 and to chosen-prefix collisions in 2020. Neither belongs in a digital signature, a certificate, or a tamper-detection scheme — only in non-security checksums and legacy compatibility. And none of the four should store passwords: plain SHA-256 runs billions of times per second on one modern GPU, so passwords need a deliberately slow, salted KDF such as bcrypt, scrypt, or Argon2.
- SHA-1, SHA-256, and SHA-512 come from the browser's built-in Web Crypto API (
crypto.subtle.digest), which is only exposed in a secure context — HTTPS orlocalhost. Opened over plain http, those three cards cannot produce a value. MD5 is a pure-JavaScript implementation and is unaffected. - The output is a raw digest and nothing more. No HMAC, no salt field, no Base64 output, no uppercase toggle, and no SHA-384, SHA-3, or BLAKE variants. If the value you are comparing against is uppercase or Base64, convert it yourself first.
Frequently asked questions
Browsers do not support MD5 — so how is it computed here?
Correct observation. Web Crypto's crypto.subtle.digest offers only SHA-1, SHA-256, SHA-384, and SHA-512; MD5 was deliberately left out of the specification because it has long been considered broken and browsers should not provide a first-class path to it. This tool therefore computes MD5 with spark-md5, a pure-JavaScript implementation that ships with the page and runs on your device. No server is involved either way; the SHA family goes through the native Web Crypto API.
My SHA-256 here does not match what my backend computes. How do I track it down?
Work through this list: a trailing newline present on one side and not the other; \r\n versus \n; a backend encoding that is not UTF-8 (UTF-16 or a legacy codepage produces entirely different bytes for non-ASCII text); whitespace being trimmed, or a byte order mark and full-width spaces picked up when copying from a web page; the other side actually computing an HMAC or adding a salt; and output that is Base64 or uppercase hex rather than lowercase hex. A plain hash has no random component, so identical bytes always give identical output — any mismatch is a difference in input or in representation.
Is my input uploaded anywhere?
No. All four digests are computed on your device: MD5 through the bundled spark-md5, and SHA-1 / SHA-256 / SHA-512 through the browser's own crypto.subtle.digest. No network request is made at any point. You can verify it by disconnecting from the network and typing again — as long as the page loaded over HTTPS, all four keep working.
Can the original text be recovered from a hash?
No. Hashing compresses input of any length into a fixed-size output — SHA-256 is always 32 bytes — discarding information along the way, so no unique inverse exists mathematically. The only digests anyone can "look up" are those of common strings someone already hashed and recorded. The flip side matters in practice: hashing does not protect low-entropy data. SHA-256 of a national ID or a phone number is reversible by exhaustive search because the space of possible values is small. Those fields need a salt or an HMAC.
Which algorithm should I pick?
Start with SHA-256 for anything new; it is the current industry default and fast enough. SHA-512 is often actually faster on 64-bit hardware and is a good fit for digesting long content or when you want more output bytes as key material. Use MD5 or SHA-1 only when an existing system dictates it — a legacy signature scheme or an old database column. And if the goal is preventing malicious substitution, a hash alone is not enough: an attacker who can change the content can change the published hash too. That calls for a signature or an HMAC.
Can I use this to verify a downloaded installer?
No. This tool only reads the text box, and pasting a few hundred megabytes into it is not practical. Use your operating system instead: sha256sum file.iso on Linux, shasum -a 256 file.iso on macOS, certutil -hashfile file.iso SHA256 on Windows. You can paste the resulting string back in here to compare it side by side with the vendor's published value.