Hash Generator

How Hash Generator Works

A hash function takes any input text and produces a fixed-length string of characters (the "hash" or "digest") that's effectively unique to that exact input -- change even one character of the input and the hash comes out completely different. This tool computes two common hashes, MD5 and SHA-256, of whatever text you type, live and entirely client-side in your browser -- your text is never sent to a server.

Formula & Method

MD5 is computed here with a from-scratch JavaScript implementation of the RFC 1321 algorithm (since browsers' native SubtleCrypto API doesn't include MD5), producing a 128-bit digest shown as 32 hex characters. SHA-256 is computed using the browser's built-in crypto.subtle.digest('SHA-256', ...), producing a 256-bit digest shown as 64 hex characters. Both operate on the UTF-8 byte encoding of your input text.

Worked Example

The text Hello, World! (the tool's default) hashes to MD5 65a8e27d8879283831b664bd8b7f0ad4 and SHA-256 dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f. Adding or removing so much as a trailing space would produce two entirely different hashes -- that avalanche effect is exactly what makes hashes useful for detecting even tiny changes to a file or message.

Frequently Asked Questions

Is MD5 safe to use for passwords?

No. MD5 is fast to compute and has known collision weaknesses, which makes it unsuitable for passwords or anything security-sensitive -- an attacker with modern hardware can brute-force or find collisions for MD5 hashes relatively cheaply. It's still fine for non-security uses like checksums, cache keys, or detecting accidental data corruption.

Which hash should I use, MD5 or SHA-256?

For anything where security matters even a little -- verifying file integrity from an untrusted source, generating tokens, or similar -- use SHA-256. MD5 is only appropriate for quick, non-adversarial checks like deduplication or cache keys, where speed matters more than resistance to deliberate tampering.

Does this tool send my text anywhere?

No -- both hashes are computed entirely in your browser using JavaScript (MD5) and the browser's native Web Crypto API (SHA-256). Nothing you type is transmitted to this site's server or anywhere else.

Why does SHA-256 sometimes show an error instead of a hash?

The crypto.subtle API that SHA-256 relies on is only available in a "secure context" -- meaning the page is served over HTTPS or from localhost. If it's shown over plain HTTP for some reason, SHA-256 will report that it needs a secure context, though MD5 will still work regardless since it doesn't depend on that browser API.