How it works
This tool computes the MD5, SHA-1, SHA-256 and SHA-512 hash of any text you type, entirely in your browser — nothing is sent anywhere. A hash is a one-way fingerprint: the same input always produces the same output, but you can't reverse a hash back into the original text. Use it to verify a file's checksum, compare two pieces of text without exposing them, or test your own code against known values.
One thing this tool is not for: hashing passwords for storage. MD5 and SHA-1 are fast by design, which is exactly wrong for that job — a real system uses a deliberately slow function like bcrypt, scrypt or Argon2 (see key stretching in our glossary) so that guessing billions of passwords per second isn't possible.
Related terms: Hash · Salt (salting) · Key stretching · CSPRNG
FAQ
Is my text sent anywhere?
No. Every hash is computed locally in your browser using the Web Crypto API (for SHA-1/256/512) and a local JavaScript implementation (for MD5) — nothing you type ever leaves your device.
Why are MD5 and SHA-1 marked as insecure?
Both have known collision attacks — it's possible to construct two different inputs that produce the same hash, which breaks their use for things like digital signatures or certificates. They're still fine for checksums and non-adversarial uses like verifying a download wasn't corrupted.
Which hash should I use for a new project?
SHA-256 is the safe modern default for general-purpose hashing. For password storage specifically, use a dedicated slow function (bcrypt, scrypt, Argon2) — never a raw hash like SHA-256 by itself.
Can I hash a file, not just text?
Not with this tool — it only hashes the text you type or paste. For files, your operating system's built-in checksum tools (certutil on Windows, shasum or md5 on macOS/Linux) are the standard option.