Versatile WebWorks logo
Versatile Web Works
HomeUtilitiesBlogWrite For UsContact
Back to Utilities

Hash Generator

Compute MD5, SHA-1, SHA-256, and SHA-512 hashes of any text.

Advertisement
Loading...

What this tool does

Cryptographic hash functions transform input of any length into a fixed-size output (digest) that uniquely represents the input. They are one-way: given a hash, you cannot derive the original input, and small changes to the input produce completely different hashes. This tool computes MD5, SHA-1, SHA-256, and SHA-512 digests of any text input directly in your browser.

MD5 and SHA-1 are considered cryptographically broken and should not be used for security-sensitive applications like password storage or digital signatures. SHA-256 is currently the standard for most use cases, including TLS certificates, blockchain transactions, and integrity verification. SHA-512 offers the highest security margin and is faster on 64-bit hardware despite producing a longer digest.

Usage Example

// SHA-256 of "hello"
// "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

// Use the Web Crypto API
const data = new TextEncoder().encode("hello");
const hashBuffer = await crypto.subtle.digest("SHA-256", data);
const hashHex = Array.from(new Uint8Array(hashBuffer))
  .map(b => b.toString(16).padStart(2, "0")).join("");
// "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

// Use bcrypt or Argon2 for passwords, never plain SHA

Common Edge Cases

  • Hash functions are deterministic: the same input always produces the same output. This makes them great for integrity checks but bad for storing passwords.
  • MD5 and SHA-1 have known collision attacks, where two different inputs produce the same hash. This breaks their use for digital signatures and file integrity in adversarial contexts.
  • For password storage, use a slow, salted hash function like Argon2id, bcrypt, or scrypt. SHA-256 is too fast and allows attackers to test billions of guesses per second.
  • Empty input still produces a valid hash, so the input length must be validated separately if it matters for the application.
  • Hashing the same input with the same algorithm always produces the same output. To add randomness for non-security use cases like deduplication, consider BLAKE3 with a personalization parameter.

FAQ

Which hash algorithm should I use?
Use SHA-256 for general integrity verification, digital signatures, and commitment schemes. Use Argon2id or bcrypt for password storage. Avoid MD5 and SHA-1 for any security-sensitive purpose.
Can two different inputs produce the same hash?
Yes, this is called a collision. The probability for SHA-256 is 1 in 2^128 by the birthday paradox, which is negligible in practice. MD5 and SHA-1 have practical collision attacks that are computationally feasible.
Why is the output always the same length?
Hash functions compress input of any size into a fixed-length output (256 bits for SHA-256, 512 bits for SHA-512). This is the same mathematical function applied to any input, producing a digest of the same size.
Advertisement