Developer Tools New Tool

Free Online Hash Generator, MD5, SHA-1 and SHA-256 From Text

Turn any text into an MD5, SHA-1 or SHA-256 hash, all three at once. Useful for a checksum, a cache key or comparing a value against one you were given. The hashing is done by your browser with a checked implementation, so the text you are hashing never travels to a server to be read.

Free Forever Nothing Uploaded All Three at Once As You Type

Free Online Hash Generator, MD5, SHA-1 and SHA-256 From Text

Advertisement Slot (Top Banner) Google AdSense Unit • Responsive Banner

Hash Generator Everything happens in this tab. Nothing you paste is sent anywhere.

Your text

The hashes

MD5 broken

SHA-1 broken

SHA-256 safe

Compare

Buy Us A Coffee

Enjoying WizTools123? Help keep our server infrastructure 100% free and open for everyone.

Buy Us A Coffee

Sponsored Content (Below Tool) Google AdSense Placement

MD5 and SHA-1 Are Broken. Use Them Anyway?

It depends entirely on what you are using them for.

Hash	For security?	What it is still fine for
MD5	No	A cache key, a checksum against accidental corruption, an ETag. Anywhere an attacker is not trying to fool you.
SHA-1	No	Git still uses it for object names. Fine for identifying content, not for proving it was not tampered with.
SHA-256	Yes	Everything the other two do, plus signatures, integrity checks and anywhere an attacker might try to forge a match.

Broken means someone can build two different inputs with the same hash, not that the hash stopped working. MD5 and SHA-1 still turn the same input into the same output every time, which is all a cache key or a checksum needs. What they can no longer do is prove that a file was not swapped for a different one, because an attacker can craft a different file with a matching hash. For that, and for anything a password or a signature touches, use SHA-256.

A hash is not encryption, and it is not reversible. There is no way to turn a hash back into the text it came from; that is the point of it. Sites that claim to "decrypt" an MD5 are really just looking it up in a huge table of pre-computed common inputs. If your input is a common word or a leaked password it will be in such a table, which is exactly why a bare hash is a poor way to store passwords.

Where Your Input Goes

Nowhere. And you can check that yourself.

A password or secret can be hashed here because the text never leaves your browser. It is all done by your own browser. Press F12, open the Network tab, and use the tool: the page fetches its own code and nothing else. Or load the page, turn off your wifi, and carry on. It still runs, because there was never a server in the middle.

How to Generate a Hash

A few steps, and nothing is uploaded.

Type or paste your text The three hashes appear as you go. Nothing is uploaded, so a password or a secret is safe to hash here.

Read all three at once MD5, SHA-1 and SHA-256 side by side, each labelled with whether it is safe for security.

Compare against a hash you were given Paste it into the compare box and the tool tells you which of the three, if any, it matches.

Copy the one you need Each hash has its own copy button.

What to Know About Hashing

Including the things this tool cannot do.

All three are computed here in your browser, by hand-written code checked against Node's crypto library. The usual way to hash in a browser is the built-in crypto.subtle, but it is asynchronous and, more importantly, it refuses to run at all outside a secure context, so it fails on plain http and on a file opened from disk. The implementation here has none of those limits and gives byte-for-byte the same result.

A hash is one-way; it cannot be turned back into the text. Sites that offer to "decrypt" a hash are looking it up in a table of common inputs and their known hashes. If your text is a real word or a common password, it is in those tables. This is the reason a bare hash, especially MD5, is a bad way to store passwords: use a purpose-built password hash with a salt instead.

MD5 and SHA-1 are broken for security but fine for identity. Broken means an attacker can construct two different inputs with the same hash, which defeats using them to prove a file was not altered. It does not stop them being a good cache key, ETag or checksum against accidental corruption, which is why Git still uses SHA-1 and why MD5 is everywhere. When in doubt, SHA-256.

The same text always gives the same hash, and a single changed character changes all of it. That is what makes a hash useful for spotting differences: two files with the same SHA-256 are the same file, and one byte of difference produces a completely different hash. It also means whitespace counts, so a trailing newline you cannot see will change the result.

Key Features & Capabilities

What this tool does, and what it deliberately does not.

Three at once MD5, SHA-1 and SHA-256 from the same text, side by side.

Checked implementation Written by hand and matched byte for byte against Node's crypto.

Compare a hash Paste one you were given and see which of the three it matches.

Honest about security Each hash is labelled broken or safe, because it matters which you use.

As you type No button. The hashes update live, even without a secure context.

Nothing uploaded A secret or a password can be hashed here without it leaving the tab.

About the Hash Generator

A hash turns any amount of text into a short fixed-length fingerprint. The same input always gives the same fingerprint, and any change to the input changes it completely. That makes hashes the quiet workhorse behind cache keys, checksums, file identity, ETags and content addressing, and it is why a developer reaches for one several times a week.

This gives you the three that come up most, MD5, SHA-1 and SHA-256, from the same text at once. They are computed in your browser by code that has been checked byte for byte against Node, which matters because the browser's own hashing refuses to run on plain http or a local file. There is also a compare box, so a hash someone sent you can be checked against your text in one step.

It is honest about which hash to use. MD5 and SHA-1 are broken for anything security depends on, because an attacker can build a collision, but they are still perfectly good for a cache key or a checksum. SHA-256 is the one to reach for when it has to be trustworthy. And no hash is reversible, so a page offering to decrypt one is really just a lookup table of common inputs.

Frequently Asked Questions

Which hash to use, why you cannot reverse one, and what broken means.

No, and nobody can. A hash throws information away on purpose, so there is no way back to the original text. Sites that claim to decrypt a hash are looking it up in a table of common inputs; if your text is unusual it will not be found, and if it is a common password it will, which is the whole problem with storing passwords as bare hashes.

Only where security is not involved. As a cache key, an ETag or a checksum against accidental corruption, MD5 is fine and fast. For anything where someone might try to fool you, it is broken, because a collision can be constructed. Use SHA-256 there.

Almost always whitespace or encoding. A trailing newline, a space, or a different character encoding changes the input and therefore the hash. This tool hashes exactly the text in the box as UTF-8. Check for an invisible newline at the end first.

Yes. The three algorithms are implemented from their specifications and tested byte for byte against Node's crypto library, including the known reference vectors and Unicode input. They are done this way rather than with the browser's built-in hashing because that refuses to run outside a secure context.

No. Everything is hashed in your browser. That is the reason this can be used on a password or a secret: there is no server to receive it, which you can confirm in the Network tab or by working offline.