Overview
A hash is a fingerprint for data. Feed in a word, a paragraph or a whole file and a hash function produces a fixed-length string that represents it. Change one letter of the input and the fingerprint changes completely — which is why hashes are used everywhere, from checking that a download arrived intact to recognising files without opening them.
This page computes five of the best-known hashes side by side, live as you type. MD5 and SHA-1 are included because older software and documentation still quote them constantly; SHA-256, SHA-384 and SHA-512 are the modern SHA-2 members to reach for in new work. Every calculation happens in your own browser — including the MD5, which many tools send off to a server instead.
What is a hash function?
A hash function is a one-way recipe. It accepts input of any size and returns output of one fixed size — 128 bits for MD5, 256 bits for SHA-256, and so on — with three properties that make it useful. First, it is deterministic: the same input always produces the same output, on any machine, forever. Second, it is effectively irreversible: seeing a hash tells you nothing practical about the input, other than letting you test a guess by hashing it and comparing. Third, it is sensitive: near-identical inputs produce wildly different outputs, an effect called avalanche, so two files that differ by a single byte share nothing recognisable in their fingerprints.
Those properties make hashes ideal as integrity checks and identifiers. They do not make them encryption. A hash has no key and cannot be "decrypted", and a fast hash on its own is not a safe way to store passwords — that job needs slow, salted password-hashing schemes such as bcrypt or Argon2. Knowing which tool fits which job is most of practical security.
Features
- Five algorithms on one screen — MD5, SHA-1, SHA-256, SHA-384 and SHA-512, computed together so you never have to run the same text five times.
- Truly live results that refresh as you type, paste or delete, with no calculate button to press.
- A self-contained MD5 implementation in JavaScript, because the browser's crypto API omits MD5 — here it runs locally just like the others.
- SHA hashes from the browser's native crypto engine, the same code your browser uses for secure connections.
- Correct UTF-8 handling, so accented letters and emoji hash to the same values other proper tools produce.
- An uppercase toggle for the many systems and documents that quote hashes in capital letters.
- A copy button on every row, so each fingerprint can be lifted individually without selecting text by hand.
- Nothing leaves the page — no analytics payload, no server round-trip, no stored history of what you hashed.
Benefits
- Safe for sensitive snippets. API keys, internal hostnames and draft documents can be hashed here without being handed to a third-party server.
- Quicker debugging. Comparing a hash from your code against a known-good one immediately shows whether the difference is in the data or in the algorithm.
- Download checks without extra software. Verify a checksum published by a software project before you install what you downloaded.
- All the common variants in one visit. Old documentation quotes MD5, new documentation quotes SHA-256 — both are answered here.
Who can use it
Developers comparing outputs between a script and a reference value, system administrators verifying installers and disk images, and support staff confirming two copies of a file are identical without sending the file anywhere. It also serves students meeting hashes for the first time — typing one character and watching every fingerprint change is the fastest way to grasp the avalanche effect — and anyone following a guide that says "check the SHA-256" before trusting a download.
How to use
- Type or paste your text into the box. The five fingerprints appear immediately and keep updating with every keystroke.
- Decide which algorithm you need. When in doubt, take SHA-256; use MD5 or SHA-1 only when matching a value something else already published.
- Switch on the uppercase toggle if the place you are comparing against shows hashes in capitals — the digits are the same either way, only the letter case changes.
- Press the Copy button on that row and paste the hash where it is needed.
- To verify data, hash it here and compare the result character by character with the published value. Any mismatch means the data differs — do not proceed until you know why.
Frequently asked questions
Can a hash be turned back into the original text?
Not by reversing it. Hash functions are one-way by design, so the only route back is guessing the input, hashing the guess, and checking whether the fingerprints match. That is why short, predictable inputs — a single word, a four-digit PIN — are weak even when hashed: the guesses are cheap to enumerate. Length and unpredictability still matter.
Is MD5 broken? Should I avoid it?
For collision resistance, yes, MD5 is broken: researchers can craft two different inputs with the same MD5 fingerprint, so it must not be used to sign documents or certificates. For humble jobs — spotting accidental corruption, matching a legacy checksum, deduplicating files — it remains serviceable. This page offers it for those compatibility jobs and labels it honestly.
Which hash should I use for checking a download?
Whichever one the publisher provides, ideally SHA-256 or stronger. The check only works if you compare against a value supplied through a trustworthy channel, such as the project's official site over HTTPS. A checksum printed next to the download link on the same page proves integrity against corruption, not against a fully compromised site.
Why do two similar texts produce completely different hashes?
That is the avalanche effect, and it is deliberate. Flipping one input bit scrambles roughly half of the output bits. If similar inputs produced similar hashes, attackers could walk gradually towards a target; instead, every guess is a fresh lottery ticket.
Is it safe to hash a password here to store it?
The hashing itself is safe here because nothing leaves your browser, but fast hashes are the wrong tool for storing passwords in your own systems. Use a dedicated password-hashing function such as bcrypt, scrypt or Argon2, which add salt and deliberate slowness. Use this page for checksums, fingerprints and comparisons instead.
Does the tool send my text anywhere for processing?
No. MD5 is calculated by a compact implementation written in JavaScript on this page, and the SHA family is calculated by your browser's own crypto engine. You can load the page, go offline, and keep hashing — a quick way to convince yourself there is no server involved.
Conclusion
Hashes are the quiet workhorses of computing: small strings that let you prove data has not changed and recognise it instantly without exposing it. Keep SHA-256 as your default, keep MD5 for the legacy corners that still need it, and let this page do the arithmetic locally, where your text belongs.