What Is a Cryptographic Hash?
A hash function maps input of any length to a fixed-length fingerprint. Change one character of the input and the digest changes unpredictably. That property makes hashes useful for checksums, cache keys, deduplication, and verifying that a downloaded file matches a published digest.
Hash Generator displays four widely referenced algorithms side by side so you can match whatever format a README, API spec, or legacy system expects.
Algorithms in This Tool
| Algorithm | Digest size | Typical use today | |-----------|-------------|-------------------| | MD5 | 128 bits (32 hex chars) | Legacy checksums — avoid for security | | SHA-1 | 160 bits (40 hex chars) | Deprecated for TLS and signatures — legacy Git uses it | | SHA-256 | 256 bits (64 hex chars) | Modern integrity checks, blockchain, certificates | | SHA-512 | 512 bits (128 hex chars) | Higher security margin where longer digests are specified |
MD5 uses the SparkMD5 library. SHA-1, SHA-256, and SHA-512 use crypto.subtle.digest from the Web Cryptography API.
Security Limitations You Should Know
MD5 and SHA-1 are not safe against intentional collision attacks. Researchers can craft two different files with the same MD5 hash. Do not rely on them to prove authenticity against motivated adversaries.
Even SHA-256 is wrong for password storage. Hashing is fast — attackers can test billions of guesses per second on GPUs. Password systems need deliberately slow functions with unique salts per user.
Use this tool for debugging, interoperability checks, and non-adversarial fingerprinting — not for designing new security mechanisms.
Text Input vs. File Checksums
Publishing sites often list SHA-256 checksums for downloadable binaries. Those hashes cover raw file bytes. Pasting file contents as text here hashes the UTF-8 interpretation of that text, which differs from hashing the binary stream unless you hex-encode the file first.
For document verification workflows, confirm whether the reference digest was computed over binary content or a canonical string representation.
Worked Example: Known Digests for "hello"
Entering the 5-character lowercase ASCII string hello (with no trailing newline) produces:
| Algorithm | Hex digest |
|---|---|
| MD5 | 5d41402abc4b2a76b9719d911017c592 |
| SHA-1 | aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d |
| SHA-256 | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
| SHA-512 | 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043 |
Changing the first letter to uppercase (Hello) completely alters every digest (the avalanche effect) — for example, SHA-256 becomes 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969.
Verifying a Known Digest
To check a candidate string against a stored hash outside this tool, hash your input here and compare strings. For salted password hashes (bcrypt strings starting with $2), this tool is not applicable — those formats embed salt and cost parameters requiring specialized verification libraries. Pair with the Regex Tester to validate 32-, 40-, or 64-character hex strings, or encode query parameters with the URL Encoder.