MD5 & SHA-256 Hash Generator
One string in, five hashes out. The one-way street of cryptography.
a085849e9c9cc9779810f67076634cc3d9cb229bbed40ff2f0da5c96828bd4a5d930a6da045ca3da39ab2cbb16c3ac3b8ba4ffef57e6c1f24b792cf90e9c557d595b9209308e3633e82b677a0f6b280fc915c6491b30852e87ba413590378a072d7d030fb4dd1a134b8fbc7be5780af1610c762dac93994a6b9351d662404a4495e20645217188ab236efda12aa7c972920c76da64237073b78b2f38773a4c1ce775aab56df2b6b391b424e4019447e74daf7832What this does
Type or paste any string and get five hash digests at once: MD5, SHA-1, SHA-256, SHA-384, and SHA-512. All computed in parallel because waiting for one at a time would be silly. Each result gets its own copy button.
Common use cases
Checking that text arrived intact. Hash it on both ends and compare. If the hashes match, not one character changed. This hashes text you type or paste, not files, so a download checksum is a job for sha256sum.
Generating deterministic IDs. Same input always produces the same output. Useful for content addressing, cache keys, and deduplication.
Checking password hashes? Not quite. Real systems store passwords with salted, deliberately slow hashes like bcrypt, so what you see here won't match your database. A plain MD5 or SHA-256 of a password is fast to compute, which is exactly what an attacker wants.
Things to know
When to use which algorithm. SHA-256 is the right choice for almost everything today: integrity checks, content addressing, deterministic IDs. SHA-1 still shows up in legacy systems (git uses it for commit hashes, though it's slowly migrating to SHA-256). SHA-512 produces a longer digest and works well when you need extra collision resistance or you're on a 64-bit system where it's actually faster than SHA-256. SHA-384 is a truncated SHA-512, mostly used in specific TLS cipher suites.
MD5 is included for compatibility with legacy systems (old checksums, short non-security IDs), but don't use it for anything where collisions matter. MD5 has had known collision attacks since 2004: attackers can craft two different inputs that produce the same hash. For anything security-adjacent in 2026, reach for SHA-256.
Hashing and encryption are different things. Encryption is reversible with the right key. Hashing isn't. That's the whole point. Each hash displays as a lowercase hex string, the standard representation for config files, verification scripts, and documentation.
Privacy
Runs entirely in your browser using the Web Crypto API. Your input never touches a server. There's nothing to intercept because there's nothing to send. Hash your API keys, deployment secrets, whatever. We literally can't see them.