Hash Generator
MD5, SHA-1, SHA-256, and SHA-512 hashes of any text, computed live in your browser using the Web Crypto API. Nothing you type is sent anywhere.
Which one should I use?
Depends on what you're hashing for.
SHA-256 is the safe general-purpose default for checksums and integrity checks. MD5 and SHA-1 are both cryptographically broken (collisions are practical to construct), fine for checking a file didn't get corrupted in transit, not fine for anything security-sensitive like password storage.
Not for passwords
None of these algorithms should be used to store passwords, they're deliberately fast, which is exactly wrong for that job. Password storage needs a slow, purpose-built algorithm like bcrypt, scrypt, or Argon2 instead.
How it works
SHA-1, SHA-256, and SHA-512 are computed by your browser's built-in
crypto.subtle.digest API: your text is converted to UTF-8 bytes with
TextEncoder, digested natively, and the resulting buffer is formatted as
lowercase hex. MD5 is the odd one out: Web Crypto deliberately refuses to implement it
(it's cryptographically broken), so this tool ships a small JavaScript implementation of
RFC 1321 just for MD5. All four recompute on every keystroke, with a guard that throws
away stale results if you type faster than the digests finish.
A practical gotcha when cross-checking against a terminal: this tool hashes exactly the
bytes you typed, with no trailing newline. echo "hello" | sha256sum will
never match it, because echo appends a newline and you're actually hashing
"hello\n". Use printf '%s' "hello" | sha256sum instead and the digests line
up exactly. The same trap explains most "why doesn't my hash match" moments between
languages and tools.
Because crypto.subtle lives inside the browser, nothing needs to be sent
anywhere to compute a digest. You can confirm it: open DevTools' Network tab and type a
password or API key into the input. No request appears, your text stays in the tab.
From the blog: Password Entropy, Explained With Real Numbers