Hash Generator (MD5/SHA)

What a hash does

A cryptographic hash takes any input and returns a fixed-length digest. SHA-256 always returns 256 bits no matter whether the input is one character or a gigabyte. Change one bit of input and roughly half the output bits change, which is what makes a digest useful as a fingerprint.

The three properties that matter are preimage resistance (you cannot work back from digest to input), second-preimage resistance (you cannot find another input with the same digest) and collision resistance (you cannot find any two inputs that collide). MD5 and SHA-1 have lost the last of these and should not be used where collision resistance matters.

Digest sizes at a glance

MD5 — 128 bits, 32 hex characters
SHA-1 — 160 bits, 40 hex characters
SHA-256 — 256 bits, 64 hex characters
SHA-512 — 512 bits, 128 hex characters

Known vectors confirm the implementation: the SHA-256 of the three characters "abc" is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. If a hash tool returns anything else for that input, it is broken.

Which algorithm to use

SHA-256 for anything security-related: password-derived keys, file integrity, signatures, cache keys. SHA-512 where you want a wider digest and the platform handles 64-bit words well. MD5 only for non-security checks such as a quick duplicate detector or reproducing a legacy checksum, and even then remember it is trivially collidable.

For passwords, a plain hash is the wrong tool entirely. SHA-256 is designed to be fast, which is exactly what an attacker wants; use bcrypt, scrypt or Argon2 with a per-user salt and a cost factor instead. A salt also defeats rainbow tables, and is not needed for a general-purpose file digest.

Why this runs in the browser

Nothing is sent anywhere: the MD5 path is a dependency-free implementation and the SHA variants use the Web Crypto API. That means the page works offline, and the text you paste — an API key, a document, a password you are checking — never leaves the machine.

Web Crypto is only available in a secure context, so SHA-1, SHA-256 and SHA-512 require HTTPS or localhost. Opened as a local file over file://, only MD5 will work. That is a browser rule, not a limitation of this page.

Frequently Asked Questions