Hash Generator: MD5, SHA-1, SHA-256, SHA-512 Online

A hash takes any input — a word, a password, a whole file — and turns it into a fixed-length string that's effectively a fingerprint of that exact input. Change one character and the hash comes out completely different. That property is why hashing shows up everywhere from password storage to file integrity checks. A hash generator computes MD5, SHA-1, SHA-256, or SHA-512 hashes of whatever you paste in.

Why you'd hash something instead of just storing it

Hashing is one-way — unlike Base64 or encryption, there's no operation that turns a hash back into the original input. That's exactly the point for passwords: a system should never store what a user typed, only a hash of it. When they log in again, it hashes their input and compares hashes. If the database ever leaks, an attacker gets hashes, not passwords.

Which algorithm to use

• SHA-256 — the current general-purpose default. Used for file checksums, Git commit content addressing, and most modern integrity checks.
• SHA-512 — same family as SHA-256, longer output, sometimes preferred for extra margin or performance on 64-bit systems.
• SHA-1 — legacy. Still shows up in older systems and Git object hashes, but considered cryptographically broken for security purposes.
• MD5 — the oldest and fastest, still fine for non-security uses like a quick file fingerprint or de-duplication key, but not something to rely on for anything adversarial.

For anything security-sensitive — verifying passwords, signing tokens — use SHA-256 or newer, and note that passwords specifically should go through a purpose-built algorithm like bcrypt or Argon2, not a raw fast hash like SHA-256 alone (fast hashes are exactly what makes brute-forcing feasible).

How to generate a hash

1. Open the Hash Generator.
2. Paste the text you want to hash.
3. Pick an algorithm — SHA-256 covers most cases.
4. The hash is computed instantly, entirely in your browser, and you copy the result.

A common non-password use: verifying a download

Software downloads are often published alongside a SHA-256 checksum. After downloading, you hash the file yourself and compare it to the published value — if they match, the file wasn't corrupted or tampered with in transit. It's the same one-way-fingerprint idea, just applied to file integrity instead of passwords.

Related developer tools

If what you actually need is a unique identifier rather than a fingerprint of existing data, that's a job for the UUID Generatorinstead — hashes are deterministic (same input, same output every time), UUIDs are random. And if you're inspecting a token that already contains a signature, the JWT Decoder shows you the payload it was computed over.