Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 hashes from text or files instantly
Which Hash Function Should You Use?
What is a hash?
A one-way function that maps any input to a fixed-length value: identical inputs always produce identical hashes, the original can't be recovered, and flipping a single bit changes the output completely.
Choosing an algorithm
SHA-256/SHA-512: current standard (NIST FIPS 180-4) — use for integrity checks, signatures, and checksums.
MD5 and SHA-1: broken by practical collision attacks; retired for security purposes. Only acceptable for non-security tasks like duplicate-file detection.
Passwords are different
Store passwords with slow, dedicated algorithms — bcrypt, scrypt, or Argon2 — plus a salt. SHA-256's speed is exactly what makes it wrong for passwords: fast hashes are easy to brute-force.
Frequently Asked Questions
A hash function is a mathematical algorithm that converts input data of any size into a fixed-size string of characters (the hash). It's a one-way function — you cannot reverse the hash to get the original data. Common uses include data integrity verification, password storage, and digital signatures.
These are different hash algorithms with varying output sizes: MD5 produces a 128-bit (32-character) hash, SHA-1 produces 160-bit (40 characters), SHA-256 produces 256-bit (64 characters), and SHA-512 produces 512-bit (128 characters). Longer hashes are generally more secure. MD5 and SHA-1 are considered cryptographically broken and should not be used for security purposes.
MD5 is NOT safe for cryptographic purposes like password hashing or digital signatures, as collision attacks have been demonstrated. However, it's still commonly used for non-security purposes like checksum verification of file downloads, deduplication, and cache keys.
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to provide both data integrity and authentication. Unlike a plain hash, HMAC ensures the message hasn't been tampered with AND was sent by someone who knows the secret key. It's widely used in API authentication and JWT tokens.
Drag and drop your file into this tool to generate its hash. Then compare the generated hash with the one provided by the file's source. If they match, the file hasn't been corrupted or tampered with during download.
No. Hash functions are designed to be one-way — it's computationally infeasible to reverse them. While rainbow tables and brute-force attacks can crack simple passwords hashed with MD5/SHA-1, properly salted and strong hashes are practically irreversible.
For security purposes (passwords, signatures), use SHA-256 or SHA-512. For file integrity checks where speed matters, SHA-256 is a good balance. For non-security uses (cache keys, dedup), MD5 is fine due to its speed. Avoid SHA-1 and MD5 for any security-critical application.
No. All hashing is performed entirely in your browser using the Web Crypto API and JavaScript. Your text and files never leave your device. This tool works completely offline once loaded.
There's no hard limit, but very large files (over 1-2 GB) may cause your browser to run out of memory. For best performance, files under 500 MB are recommended. The file is processed entirely in your browser's memory.
Hash functions are deterministic by design — the same input always produces the same output. This property is essential for verification: you can independently hash a file and compare it to a known hash to verify integrity.