Hash Generator (MD5 / SHA-1 / SHA-256)

Hash Generator (MD5 / SHA-1 / SHA-256)

A cryptographic hash function turns an input of any length into a fixed-length string of hex digits (128 bits/32 hex characters for MD5, 160 bits/40 characters for SHA-1, 256 bits/64 characters for SHA-256) — deterministically (the same input always produces the same output), and, for a well-designed function, in a way that's practically impossible to reverse (you can't recover the input from the hash) and where finding two different inputs that hash to the same output ("a collision") should be computationally infeasible.

MD5 (1992) and SHA-1 (1995) both fail that last property today. MD5 collisions have been practical since 2004 and take seconds on a laptop; SHA-1 followed in 2017 with Google's "SHATTERED" demonstration, and major browsers and certificate authorities have since stopped trusting SHA-1 certificates entirely. Neither is broken in the "can be reversed" sense — you still can't recover your original text from a hash shown above — they're broken specifically for anything that depends on collision resistance: digital signatures, certificate fingerprints, or any scheme where an attacker choosing a second input that hashes the same as yours would let them substitute a forged document, message or file for a legitimate one undetected.

SHA-256, part of the SHA-2 family (2001), has no known practical collision or preimage attack and remains the standard choice today for anything security-sensitive that isn't password storage — file integrity verification, blockchain/Merkle-tree structures, certificate fingerprints, and general-purpose data integrity checks. It's slower to compute than MD5 by design (more internal rounds), which is irrelevant for hashing a short piece of text like this tool does, but matters when hashing gigabytes of data.

None of MD5, SHA-1 or SHA-256 should ever be used to store passwords directly, even though SHA-256 itself isn't "broken" — general-purpose hash functions are deliberately fast, which is exactly the wrong property for password storage: a fast hash lets an attacker who steals a password database try billions of guesses per second. Dedicated password-hashing functions like bcrypt, scrypt or Argon2 are deliberately slow and memory-hard instead, specifically to make that kind of brute-force attack impractical. This tool computes general-purpose hashes only, for checksums and file-integrity comparisons — never use its output as a substitute for real password hashing.

Glossary

Hash function

A deterministic function that turns input data of any length into a fixed-length digest, designed to be practically impossible to reverse.

Hex digest

A hash function's output, rendered as lowercase hexadecimal characters — the format this tool (and most tools) display hashes in.

Collision

Two different inputs that produce the same hash output — the property both MD5 and SHA-1 have lost real-world resistance to, which is why both are unsafe for anything requiring forgery resistance.

MD5

A 1992 hash function producing a 128-bit digest — cryptographically broken (practical collisions since 2004), safe only for checksums/legacy compatibility.

SHA-256

A 2001 hash function (part of the SHA-2 family) producing a 256-bit digest, with no known practical collision attack — the current standard choice for integrity checks.

Checksum

A hash used to verify that data wasn't accidentally corrupted (e.g. during a file download) — not a security use case, so even MD5 remains fine for this purpose.

API equivalent

This tool has no API equivalent in our service — computing a hash isn't an IP-address fact, so there's nothing for our API to return here. The hashing above runs entirely on your device using your browser's WebCrypto engine (plus a local MD5 implementation); nothing is ever sent anywhere. If you're looking for our IP-lookup API instead, it covers geolocation, ASN/network and threat/fraud data for an IP address:

Read the full API docs

Related tools

• All developer tools
• Base64 Encoder / Decoder
• JWT Decoder

Frequently asked questions

Is MD5 safe to use?

Only for checksums and compatibility with legacy systems that already use it. Practical MD5 collisions have been demonstrated since 2004 and take seconds to generate today — never use it for passwords, digital signatures, or anything requiring resistance to deliberate forgery. Use SHA-256 instead for anything security-sensitive.

What's the difference between MD5, SHA-1 and SHA-256?

All three are cryptographic hash functions, differing mainly in output size and collision resistance: MD5 (128-bit) and SHA-1 (160-bit) both have practical, demonstrated collision attacks and are considered broken for security purposes; SHA-256 (256-bit, part of SHA-2) has no known practical collision attack and remains the standard choice today.

Can I use this to hash passwords?

No — not with any of these three. All are deliberately FAST, which is the wrong property for password storage: it lets an attacker who steals a password database try billions of guesses per second. Use a dedicated, deliberately slow password-hashing function (bcrypt, scrypt, or Argon2) for passwords instead.

Why do SHA-1 and SHA-256 take a moment while MD5 is instant?

SHA-1 and SHA-256 run through your browser's WebCrypto engine, which returns a Promise (an async operation) even for a near-instant computation; MD5 isn't part of WebCrypto, so this tool computes it synchronously with a small local implementation. For text this short the difference is imperceptible in practice.

Is my text sent to a server?

No — SHA-1/SHA-256 run through your browser's built-in WebCrypto engine and MD5 through a local implementation; this page makes no network request to compute any of the three hashes.

What's a hash collision?

Two different inputs that produce the identical hash output. A secure hash function should make finding a collision computationally infeasible; MD5 and SHA-1 have both lost that property in practice, which is why they're unsafe for anything requiring forgery resistance.