Developer Tools
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-512, and HMAC hashes from text.
5d41402abc4b2a76b9719d911017c592About hash generation
Type or paste text and its MD5, SHA-1, SHA-256 and SHA-512 hashes appear as lowercase hex, updating on every keystroke. Fill in the secret key field to add an HMAC-SHA256 signature of the same text. Each result has its own copy button. The text is hashed as UTF-8 bytes, so the output matches sha256sum or openssl for exactly the same bytes. The SHA hashes come from the browser's Web Crypto API. MD5 isn't part of that API, so the page calculates it with its own code, which gives the same results as standard MD5. Nothing is uploaded. The length tells you which algorithm you're looking at: 32 hex characters for MD5, 40 for SHA-1, 64 for SHA-256 and 128 for SHA-512. MD5 and SHA-1 are broken for security. MD5 collisions were published in 2004, and in 2012 the Flame malware used one to forge a Windows code-signing certificate. The first public SHA-1 collision followed in February 2017, from Google and the CWI institute in Amsterdam. Both are still fine as quick checksums where nobody is trying to cheat.
Frequently asked questions
Is MD5 safe to use?
Not for anything security related. Researchers showed MD5 collisions in 2004, meaning two different inputs can be made to share a hash, and RFC 6151 states that MD5 is no longer acceptable where collision resistance is required, such as digital signatures. It is still fine for catching accidental corruption, like a file damaged in transfer.
Which hash should I pick for a password?
None of these. MD5 and the SHA family are built to be fast, which makes stolen hashes quick to guess. The OWASP Password Storage Cheat Sheet recommends Argon2id, or scrypt when Argon2id isn't available, because both are deliberately slow and use a lot of memory.
Why doesn't my hash match the one from the command line?
Usually an invisible character. echo adds a newline unless you use echo -n, Windows files often end lines with a carriage return, and a trailing space counts too. Here, hello gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, the same as echo -n hello | sha256sum.
What is the HMAC field for?
HMAC mixes a secret key into the hash, so only someone with the same key can produce the same value. GitHub, for example, signs webhook deliveries with an HMAC SHA-256 digest in the X-Hub-Signature-256 header. Paste the exact payload and your secret to check a signature by hand. HMAC here always uses SHA-256.