Hash Generator (MD5, SHA-1, SHA-256, SHA-512)

A cryptographic hash function maps input of any length to a fixed-size digest. The same input always produces the same output, a single changed bit produces a completely different digest (the avalanche effect), and the function is designed to be one-way — you cannot feasibly reverse a digest back to its input. This tool computes four common digests at once so you can compare checksums, verify downloads, or match a hash you found during analysis.

How you'll use it. Paste text and read off the MD5, SHA-1, SHA-256, and SHA-512 values. Everything runs in your browser via the Web Crypto API (MD5 is implemented in-page because Web Crypto deliberately omits it), so the input never leaves your machine — safe for inspecting sensitive strings.

Worked example. The empty string always hashes to the MD5 d41d8cd98f00b204e9800998ecf8427e. If a file you downloaded produces a different MD5 than the one published, the file was altered or corrupted in transit. If you have a digest but do not know which algorithm produced it, the hash identifier narrows it down from the length and format.

Which algorithm to trust. MD5 and SHA-1 are broken for collision resistance — attackers can craft two different inputs with the same digest — so they must never be used for signatures, certificates, or integrity where an adversary controls the input. They remain fine for non-security checks like detecting accidental corruption or de-duplicating files. Use SHA-256 or SHA-512 for anything security-relevant. When you need a keyed tag rather than a bare digest — to authenticate a message, not just fingerprint it — reach for the HMAC generator instead.

Common mistake. A raw hash is not a safe way to store passwords. Fast hashes like SHA-256 let an attacker try billions of guesses per second against a stolen database. For passwords, use a slow, salted, memory-hard function — bcrypt, scrypt, or Argon2 — never a bare SHA digest, and check your candidates with the password strength checker.

Defensive angle. Publish SHA-256 checksums alongside release artifacts and serve them over a separate trusted channel so users can detect tampering. When you inventory your own systems, flag any use of MD5/SHA-1 in signing or authentication paths and migrate them to SHA-256+.