Hash Generator

MD5 (128-bit): Fast but cryptographically broken since the 1990s — practical collision attacks exist. Only use for non-security checksums and legacy compatibility. SHA-1 (160-bit): Also broken — Google demonstrated a practical collision attack (SHAttered) in 2017. Avoid for any security purpose. SHA-256 (256-bit): The current gold standard. No known practical attacks. Used in TLS/HTTPS, Bitcoin, Git (SHA-1 is being phased out), and code signing. Use this for everything new. SHA-512 (512-bit): Provides a larger security margin and is actually faster than SHA-256 on 64-bit processors because it works on 64-bit words instead of 32-bit. Use when you want extra security headroom.

A collision occurs when two different inputs produce the same hash output. By the birthday paradox, collisions become increasingly likely as the number of possible hash values decreases. MD5 has a 128-bit output (about 3.4 × 10^38 possible values), but practical collision-finding attacks have been demonstrated — an attacker can craft two different files with the same MD5 hash. SHA-256 has a 256-bit output (10^77 possible values) and no known practical collision attacks. Collisions matter for digital signatures and certificates: if you can create a collision, you might be able to forge a signature.

Enable Batch Mode and enter one value per line in the text input. Each line is hashed separately. The results table shows the input and its hash values for each selected algorithm, side by side. Download everything as a CSV file for import into Excel, a database, or any data processing pipeline. This is useful for generating hashes for a list of passwords, API keys, or file checksums in bulk.

A regular hash like SHA-256 is keyless — anyone can compute the same hash from the same input. This is fine for integrity checking (file downloads) but not for authentication. HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key: HMAC-SHA256(key, message). The resulting code can only be verified by someone who knows the key. HMACs are used for API request signing (AWS Signature V4, JWT with HS256), webhook verification (GitHub, Stripe), and cookie integrity. This tool generates standard hashes (no key). For HMAC, you need a tool or code that accepts a key.

When you download software, the publisher typically posts a SHA-256 (or MD5) checksum alongside the download link. By computing the hash of your downloaded file and comparing it to the published value, you can verify: (1) the file was not corrupted during transfer — even a single flipped bit changes the hash completely, (2) the file has not been tampered with by a man-in-the-middle attack or compromised mirror. This is especially important for security tools, OS images, and any software you plan to run with elevated privileges. Use the built-in comparison field: paste the expected hash and the tool tells you instantly if they match.

No, not directly. Regular hash functions (SHA-256, SHA-512, MD5) are designed to be fast — a modern GPU can compute billions of SHA-256 hashes per second. For passwords, you need functions specifically designed to be slow: bcrypt (cost-adjustable, OWASP recommended minimum cost 10), scrypt (memory-hard), or Argon2 (the current recommended choice). These functions take 100-300ms per verification, which is imperceptible to users but makes brute-forcing billions of guesses impractical. Use this tool for file verification, data fingerprinting, and integrity checks — use bcrypt/Argon2 for passwords.

No. All hash calculations run in your browser using the Web Crypto API (for SHA variants) and JavaScript (for MD5 compatibility). Your text, files, and passwords never leave your device.