Paste text and get its cryptographic hash in hex. Useful for checksums, cache keys, and verifying file or message integrity.
MD5
—
SHA-1
—
SHA-256
—
SHA-384
—
SHA-512
—
Embed this tool
Paste this into your page — the widget loads noindexed and links back here.
Output lengths
Algorithm
Bits
Hex characters
Status
MD5
128
32
Broken — legacy checksums only
SHA-1
160
40
Deprecated for security
SHA-256
256
64
Recommended default
SHA-384
384
96
Fine
SHA-512
512
128
Fine, fast on 64-bit
Hashing is not encryption, and not password storage
A raw SHA-256 of a password is not safe storage — it is fast, so an attacker with a leaked database can try billions of guesses per second. Password storage needs a per-user salt and a deliberately slow function (bcrypt, scrypt, Argon2). See how to create a strong password.
A property worth seeing
Change one character in the box above and every hash changes completely — there is no partial similarity. This "avalanche effect" is what makes a hash a reliable integrity check: any tampering, however small, is obvious.
A fixed-length fingerprint of some input, produced by a one-way function. The same input always gives the same hash; changing a single character changes the whole output; and you cannot reverse a hash back to the input. SHA-256 always produces 64 hex characters regardless of how much text you feed it.
What is a hash used for?
Verifying that a file or message has not changed (checksums), building cache keys and content-addressed storage, deduplicating data, and — combined with a salt and a slow function like bcrypt or Argon2 — storing passwords. It is not encryption; there is no key and nothing to decrypt.
Which algorithm should I use?
SHA-256 is the sensible default for checksums and general use. SHA-512 is also fine and can be faster on 64-bit systems. SHA-1 is included because you will still meet it in older systems (Git object IDs, legacy TLS), but it is considered broken for security purposes — do not use it where collision resistance matters.
Should I use the MD5 row?
Only to reproduce a checksum from a legacy system that already uses MD5. It is cryptographically broken — collisions can be generated on a laptop — so never use it for signatures, integrity against a motivated attacker, or password hashing. The browser's Web Crypto API omits MD5 for exactly this reason, so this tool computes it in-page.
Is my text sent anywhere?
No. The hash is computed by your browser's built-in crypto engine. You can disconnect from the internet after the page loads and it still works. Nothing you paste leaves the page.
How do I verify a file download?
This tool hashes text, not files. To check a downloaded file, run the platform's checksum command (shasum -a 256 file, or CertUtil -hashfile file SHA256 on Windows) and compare the result to the hash the publisher lists. The hex string should match exactly.
Can two different inputs have the same hash?
In theory yes — that is a 'collision' — but for SHA-256 and above, finding one is computationally infeasible with current technology. For SHA-1, collisions have been demonstrated, which is why it is deprecated for security use.
Last reviewed: September 2026. Figures and formulas are checked against their published sources; see the site's data notes.