Hash Generator
Hash whatever you paste in. The SHA family uses the browser's own crypto implementation; MD5 is not in that standard and is implemented here directly — it was left out because it is not secure, but matching values against an older system is still real work that people have to do.
What you enter never leaves your device. Everything runs in your browser; nothing is sent or stored anywhere.
What a hash does
However long the input, the output has a fixed length: MD5 is 32 hex characters, SHA-1 is 40, SHA-256 is 64, SHA-512 is 128. The same input always gives the same value, and changing a single character changes the whole value. There is no way back from the value to the text, which is what makes it useful for checking that a download is intact, that two pieces of data are identical, or for choosing a cache key.
SHA comes from the browser, MD5 is implemented here
The SHA family is computed with crypto.subtle.digest. It is built into the browser, so it is exact and fast, but it is only available on HTTPS or localhost. MD5 was dropped from the standard and the browser does not provide it, so it is implemented here following RFC 1321. It is kept for people who need to match values from an old system, and the screen says not to use it for anything new. Keyed hashing, HMAC, is not offered.
A hash is computed from bytes, not characters
The input is converted to UTF-8 and those bytes are hashed. The same characters saved in a legacy encoding or in UTF-16 produce a different value, and a Windows file with \r\n line endings differs from one with \n. A three-byte BOM at the start of a file goes into the value too. When your value does not match one from elsewhere, suspect these bytes before suspecting the text.
All four at once, in lowercase
There is no algorithm to choose: all four are computed together and shown side by side, so when you do not know which one produced a value, compare lengths. Output is lowercase hex. If another tool gave uppercase, only the case differs — compare case-insensitively. The text is hashed exactly as entered: leading and trailing spaces count, and so does a final line break that came with the paste. Input that is only whitespace is not processed.
Checking that the implementation is right
MD5 is implemented here by hand, so some doubt is fair. The example abc is the test vector from the specifications: MD5 must give 900150983cd24fb0d6963f7d28e17f72, and SHA-256 must start ba7816bf and end f20015ad. If a value disagrees with another implementation, first check that tool's input for an invisible character.
Frequently asked questions
Should I use MD5 or SHA-1?
Not for anything new. Both have demonstrated collisions, meaning a different input can be constructed that produces the same hash. For storing passwords, use a purpose-built function such as bcrypt or argon2 rather than a hash. These are here for checking against existing values.
Can it hash a file?
Text only for now. For a file checksum, your operating system's own command (shasum, certutil) is quicker.
Can I store passwords with SHA?
No. SHA is built to be fast, and modern hardware tries billions of guesses a second. Passwords need a deliberately slow function — bcrypt, scrypt or Argon2 — with a different salt per user.
Same text, different hash.
Something invisible differs. A single trailing newline or stray space changes the whole value. If you are comparing against a file's hash, check whether your editor appends a newline on save.
Can I add an HMAC key or a salt?
No. A salt you can apply yourself by pasting it before or after the text. HMAC is a different construction — the key is mixed in twice, inside and outside, across two hashes — so it cannot be reproduced by concatenation. To verify a signature, use your language's HMAC function.
Does anything I paste get sent to a server?
No. Everything runs inside your browser and nothing is uploaded or stored. That is why you can use it on things you would not normally paste into a web page, like an internal config file or a production query. It also works with your network disconnected.