Hash Generator
Type text and get every hash at once - SHA-256, SHA-384, SHA-512, SHA-1 and MD5. The SHA family comes from your browser's own cryptography engine. Nothing is uploaded.
Enter some text above to generate hashes.
Enter some text above to generate hashes.
Enter some text above to generate hashes.
Enter some text above to generate hashes.
Enter some text above to generate hashes.
What a hash actually is
A hash function takes input of any size and returns a fixed-length fingerprint. A single character of text and an entire film both produce exactly 64 hexadecimal characters from SHA-256, and the same input always produces the same output.
Two properties make it useful. It runs one way - given a hash there is no method of recovering the input short of guessing. And it avalanches: change one bit of the input and roughly half the output bits flip, so there is no partial resemblance between the hashes of two similar files. That is why hashes work for verifying that a download arrived intact, and for spotting that a file changed without storing the file itself.
SHA-256
SHA-256 is the sensible default and the one to pick unless something specifically requires otherwise. It is part of the SHA-2 family, produces a 256-bit digest written as 64 hexadecimal characters, and has no practical break after two decades of attention. It underpins TLS certificates, Git object identifiers, Bitcoin and the checksums published alongside most software downloads.
SHA-384 and SHA-512 are the same design with a larger digest. They are not meaningfully more secure for ordinary use - SHA-256 is not the weak link in any realistic system - but they are sometimes mandated, and on 64-bit hardware SHA-512 is often slightly faster despite the longer output.
MD5 and SHA-1 are broken
Both are included here because real files and real systems still use them, and you need to be able to check one. Neither should be chosen for anything new.
MD5 has been comprehensively broken since 2004. Collisions - two different inputs with the same hash - can be produced on a laptop in seconds, and this has been exploited in practice: the Flame malware forged a Microsoft code-signing certificate using an MD5 collision. SHA-1 followed in 2017, when Google and CWI produced two different PDFs sharing one SHA-1 hash, and the cost of doing so has fallen steeply since.
What that means in practice: neither can be trusted to prove a file has not been tampered with, because an attacker who controls the content can arrange a match. They remain fine as non-security checksums - detecting accidental corruption, or as a cheap key for deduplication - and that is the only role they should still be given.
Do not use these to store passwords
This trips people up because it sounds exactly like what hashing is for. It is not. The SHA family is designed to be fast, and speed is precisely what an attacker with a stolen database wants - modern hardware tests billions of SHA-256 guesses per second, so a hashed password list falls quickly regardless of the algorithm.
Password storage needs a deliberately slow, memory-hard function with a per-user salt: Argon2id, scrypt or bcrypt. That is a different tool for a different job. Argon2id is what the Snoq app uses to turn your passphrase into an encryption key, for exactly this reason.
It is also worth separating hashing from encryption. Hashing is one-way and has no key - there is nothing to reverse it with, by design. Encryption is two-way and keyed, so the original comes back if you have the secret. If what you want is to get your text back later, you want the AES encryption tool, not this page.
Questions
Is MD5 still safe to use?
Not for security. MD5 collisions have been practical since 2004 and can be generated in seconds, and the technique has been used to forge a real code-signing certificate. It is acceptable only as a non-security checksum for detecting accidental corruption. Use SHA-256 for anything that matters.
Can a hash be reversed back to the original text?
No. Hashing is one-way and discards information, so there is nothing to reverse. Sites that appear to reverse hashes are looking the value up in a precomputed table of common inputs, which works only for short or predictable text.
What is the difference between hashing and encryption?
Encryption is two-way and uses a key, so the original can be recovered by anyone holding the secret. Hashing is one-way with no key and cannot be undone. Use encryption when you need the content back, and hashing when you only need to verify that something matches.
Which hash should I use?
SHA-256, unless something you are working with specifically requires another. It is secure, universally supported and fast enough for any normal purpose. Use SHA-512 where it is mandated, and treat MD5 and SHA-1 as read-only formats you check rather than choose.
Can I use SHA-256 to store passwords?
No. SHA-256 is fast by design, which lets an attacker test billions of guesses per second against a stolen database. Password storage needs a deliberately slow, memory-hard function such as Argon2id, scrypt or bcrypt, together with a per-user salt.
Is my text sent to a server to be hashed?
No. The SHA hashes are computed by your browser's built-in Web Crypto API and MD5 runs in JavaScript on the page. No request carrying your text is made.
Related tools
The same thinking, applied to your notes
Snoq keeps a whole notes database encrypted with AES-256 on your own disk, with keys derived using Argon2id rather than a fast hash. Rich text, tabs, full-text search, PDF export. Free, Windows, no account and no cloud.
Download Snoq for Windows