Hash Generator
A hash maps any input to a fixed-length digest, and changing one bit changes roughly half the output. These use the browser's Web Crypto API, so SHA-1, SHA-256 and SHA-512 match your language's standard library exactly. MD5 and SHA-1 are broken for security use and remain only for checksums.
Type or paste text below — all four hashes update live, computed entirely in your browser. Nothing you enter ever leaves this page.
Four algorithms, one live comparison
A hash function takes any input and deterministically produces a fixed-length "fingerprint" — the same input always produces the same output, but there's no way to work backward from the hash to recover the original text. MD5 (1992) produces a 128-bit digest, 32 hex characters, and is the fastest of the four, but real collisions have been found since 2004. SHA-1 (1995) produces 160 bits, 40 hex characters, and was the web's default for years before a practical collision attack in 2017 ended that. SHA-256 and SHA-512, both part of the newer SHA-2 family, produce 256-bit and 512-bit digests (64 and 128 hex characters) and remain the standard choice whenever security actually matters — TLS certificates, code signing, and Bitcoin's proof-of-work all rely on SHA-256.
Worked example
Input: Hello, World!
- MD5 →
65a8e27d8879283831b664bd8b7f0ad4 - SHA-1 →
0a0a9f2a6772942557ab5355d76af442f8f65e01 -
SHA-256 →
dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f -
SHA-512 →
374d794a95cdcfd8b35993185fef9ba368f160d8daf432d08ba9f1ed1e5abe6cc69291e0fa2fe0006a52570ef18c19def4e617c33ce52ef0a6e5fbe318cb0387
Change one character — a lowercase "h" instead of capital "H" — and all four outputs come out completely different, with no visible relationship to the originals. That's the avalanche effect in action.
Frequently asked questions
Are MD5 and SHA-1 safe to use?
Not for anything security-related. Both are cryptographically broken: practical collision attacks (two different inputs producing the same hash) have been demonstrated for MD5 since 2004 and for SHA-1 since 2017 (the "SHAttered" attack). That means they're unsafe for password storage, digital signatures, or verifying that a file hasn't been tampered with by an adversary. They're still fine for non-security uses — checksums to catch accidental corruption, deduplicating files, or generating a quick fingerprint for a cache key. For anything where security matters, use SHA-256 or SHA-512 instead.
What's the actual difference between the four algorithms?
Digest length and design generation. MD5 produces a 128-bit (32 hex character) digest; SHA-1 produces 160 bits (40 characters); SHA-256 and SHA-512 are both part of the newer SHA-2 family and produce 256 bits (64 characters) and 512 bits (128 characters) respectively. Longer digests mean astronomically more possible outputs, which is a big part of why SHA-2 has resisted the kind of collision attacks that broke MD5 and SHA-1. SHA-512 is often faster than SHA-256 on 64-bit hardware despite being longer, because its internal operations are designed around 64-bit words.
Why does changing one character completely change the hash?
That's the avalanche effect, a deliberate design property of every cryptographic hash function: flipping a single bit of input should flip roughly half the output bits, with no visible pattern connecting the two. Try it — hash "hello" and then "Hello" and compare. This is what makes hashes useful as fingerprints: a hash that changed only slightly for a similar input would leak information about the input itself.
Is my text uploaded anywhere?
No. SHA-1, SHA-256, and SHA-512 run through your browser's built-in Web Crypto API, and MD5 runs through plain JavaScript on this page — both entirely client-side. Nothing you type is sent to a server, logged, or stored; closing or reloading the tab discards it completely.