What is the difference between SHA-1 and SHA-256?

SHA-1 produces a 160-bit digest and has had practical collision attacks since 2017, so it should not be used for signatures or integrity checks. SHA-256 produces a 256-bit digest, is part of the SHA-2 family, and has no known practical attack.

Can a hash be decrypted?

No. A hash is a one-way function, so there is no key and no reverse operation. The only way to find the input is to guess candidates and hash each one, which is why passwords should be hashed with a slow, salted algorithm such as bcrypt or Argon2 rather than plain SHA-256.

Should I still use MD5?

Only to check an old download that publishes nothing else. MD5 collisions have been practical since 2004, so it must not be used for signatures, passwords or integrity checks; the browser’s WebCrypto API does not even implement it, which is why this tool computes it in plain JavaScript.

Why do I get a different hash from another tool?

Usually because of a trailing newline, different line endings, or a byte order mark. Hashes are computed over exact bytes, so one invisible character produces a completely different digest.

Hash Generator

MD5, SHA-1, SHA-256, SHA-384, SHA-512 and HMAC for text or a file.

About Hash Generator

A hash generator that computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests or HMACs of any text or file at once, entirely in your browser.

How to use

Type or paste text, or choose a file. All five digests update about 150 ms after you stop typing and are dimmed while they are being recomputed; there is no button to press. The empty string has a digest too.
Enter an HMAC key to turn every row into an HMAC with that key instead of a plain digest.
Each algorithm has its own Copy button. Copy on the panel copies all five, and Download saves them as hashes.txt.
Press Clear to start again.

What it supports

Algorithm	Digest length	Status
MD5	128 bits, 32 hex characters	Broken since 2004; checksums of old downloads only
SHA-1	160 bits, 40 hex characters	Broken for collision resistance since 2017; legacy use only
SHA-256	256 bits, 64 hex characters	Recommended general purpose hash
SHA-384	384 bits, 96 hex characters	SHA-2 family
SHA-512	512 bits, 128 hex characters	SHA-2 family, faster on 64-bit CPUs

Input is hashed as UTF-8 bytes, so é hashes as two bytes and whitespace and line breaks count.
Output is lowercase hexadecimal.
A file is hashed as its exact bytes; the text box is ignored while a file is chosen. Files up to 50 MB.
Not supported: SHA-3, BLAKE2, CRC32, or keys given as hex rather than text.
A hash is one-way: the tool cannot reverse a digest back to its text.

Example

The quick brown fox
→ SHA-1   c519c1a06cdbeb2bc499e22137fb48683858b345
→ SHA-256 5cac4f980fedc3d3f1f99b4be3472c9b30d56523e632d151237ec9309048bda9

Privacy

Hashing uses crypto.subtle.digest and crypto.subtle.sign in the page; MD5, which WebCrypto does not implement, is computed in plain JavaScript. No request is made, and nothing is stored.

Frequently asked questions

What is the difference between SHA-1 and SHA-256?: SHA-1 produces a 160-bit digest and has had practical collision attacks since 2017, so it should not be used for signatures or integrity checks. SHA-256 produces a 256-bit digest, is part of the SHA-2 family, and has no known practical attack.
Can a hash be decrypted?: No. A hash is a one-way function, so there is no key and no reverse operation. The only way to find the input is to guess candidates and hash each one, which is why passwords should be hashed with a slow, salted algorithm such as bcrypt or Argon2 rather than plain SHA-256.
Should I still use MD5?: Only to check an old download that publishes nothing else. MD5 collisions have been practical since 2004, so it must not be used for signatures, passwords or integrity checks; the browser’s WebCrypto API does not even implement it, which is why this tool computes it in plain JavaScript.
Why do I get a different hash from another tool?: Usually because of a trailing newline, different line endings, or a byte order mark. Hashes are computed over exact bytes, so one invisible character produces a completely different digest.

Encode & decode

GUID Generator: One or many UUIDs, version 4 or 7.
ULID Generator: Sortable 26-character IDs with a time prefix.
Password Generator: Random passwords with length and character-set controls.
Hash Generator: MD5, SHA-1, SHA-256, SHA-384, SHA-512 and HMAC for text or a file.
Base64 Encoder / Decoder: Base64, Base32 and Base58 in both directions.
ROT13 / Caesar Cipher: Shift letters by any amount, or ROT13 in one click.
JWT Decoder: Read a token’s header and payload without sending it anywhere.
URL Encoder / Decoder: Percent-encode text for URLs, or decode it back.
HTML Entities: Escape &, < and > for HTML, or unescape them.
Base64 Image Encoder: Image to a Base64 data URL for CSS or HTML, or decode one back.
Random Number Generator: Random integers in a range, one or many, with or without repeats.
Bcrypt Generator: Hash a password with bcrypt, or check one against a hash.
AES Encrypt / Decrypt: Encrypt text with a passphrase using AES-256-GCM, or decrypt it.
Morse Code Translator: Text to dots and dashes, and back.

Data formats

XML ⇄ JSON: Convert between XML and JSON, from text or a file.
YAML ⇄ JSON: Convert between YAML and JSON, from text or a file.
CSV ⇄ JSON: Convert between CSV and JSON, from text or a file.
JSON to TypeScript: Infer TypeScript interfaces from a JSON sample.
JSON to Python Dataclass: Infer Python dataclasses from a JSON sample.
JSON to Pydantic Model: Infer Pydantic models from a JSON sample.
JSON to Go Struct: Infer Go structs with json tags from a JSON sample.
JSON to Rust Struct: Infer Rust structs with serde derives from a JSON sample.
JSON to Kotlin: Infer Kotlin data classes from a JSON sample.
JSON to C# Class: Infer C# classes from a JSON sample.
Base Number Converter: Binary, octal, decimal, hex and any base up to 36.
Text ⇄ Binary / Hex: Text to binary, hex, octal or decimal, and back.
Unix ⇄ UTC: Epoch seconds or milliseconds to a readable date, and back.
Timezone Converter: Convert a time between cities, with DST handled.
Cron Converter: Describe a schedule in words and get the cron expression.
Cron Expression Parser: Explain a cron expression in words and list its next run times.
Days Between Dates: The exact time between two dates, in days, weeks, months and years.
Age Calculator: Exact age in years, months and days, and the next birthday.
Epoch Clock: The current Unix timestamp, live, in seconds and milliseconds.
CIDR / Subnet Calculator: Network, broadcast, mask and host count for an IPv4 CIDR block.
Chmod Calculator: File permissions as octal (755) or symbolic (rwxr-xr-x).

Units & measures

Angle: Degrees, radians, gradians and turns.
Area: Square metres, feet, acres and hectares.
Bits / Bytes: Bits, bytes and every prefix up to petabytes.
Energy: Joules, calories, kilowatt-hours and BTU.
Frequency: Hertz, kilohertz, megahertz and RPM.
Fuel Economy: Miles per gallon, km per litre and litres per 100 km.
Length: Metres, feet, miles, inches and nautical miles.
Power: Watts, kilowatts and horsepower.
Pressure: Pascals, bar, PSI and atmospheres.
Speed: km/h, mph, knots and metres per second.
Temperature: Celsius, Fahrenheit and Kelvin.
Time Unit: Seconds, minutes, hours, days and beyond.
Volume: Litres, gallons, pints and cubic metres.
Weight: Kilograms, pounds, ounces and stone.

Text & code

Lorem Ipsum Generator: Placeholder paragraphs, sentences or words.
Slug Generator: Turn a title into a URL-safe slug.
Text Compare: Diff by line, word or character, unified or side by side.
URL Parser: Break a URL into host, path, query and fragment.
JSON Formatter & Validator: Validate, pretty-print or minify JSON.
JSON Diff: Compare two JSON documents, ignoring key order and formatting.
JSONPath Tester: Query JSON with a JSONPath expression.
SQL Formatter: Format and indent SQL for any dialect.
JavaScript Beautifier: Format minified or messy JavaScript into readable code.
HTML Formatter: Indent and tidy HTML, or strip it down to one line.
XML Formatter: Pretty-print or minify XML, with error positions.
CSS Minifier / Beautifier: Minify CSS, or expand it back to readable rules.
HTML to Markdown: Convert HTML to clean Markdown.
Text Case Converter: camelCase, snake_case, kebab-case, Title Case and more.
Markdown Previewer: Render Markdown as you type.
Whitespace Remover: Strip line breaks, extra spaces or both.
Sort Lines: Sort lines alphabetically, numerically, by length or reversed.
Duplicate Line Remover: Keep each line once.
String Counter: Characters, words, lines and bytes.
Regex Tester: Test a pattern against text with live matches.
Regex Cheatsheet: Regular-expression syntax with examples.

Word play

Palindrome Checker: Does it read the same backwards?
String Reverser / Rotator: Reverse a string or rotate it by n characters.
Roman Numeral Converter: 1984 ⇄ MCMLXXXIV.
NATO Phonetic Alphabet: Spell text out as Alfa, Bravo, Charlie.
Pig Latin Converter: English to Pig Latin and back.
Numeronym Generator: internationalization → i18n.
Leetspeak Translator: Text to l33t and back.
Word Frequency Counter: Which words appear most, and how often.

Images & colour

QR Code Generator: QR codes for text, links, Wi-Fi and contacts.
Barcode Generator: EAN, UPC, Code 128 and more as SVG or PNG.
Barcode / QR Reader: Decode a barcode or QR code from an image.
Color Picker: Pick a colour and copy it in every format.
Image Converter: Convert between PNG, JPEG and WebP, and resize on the way.
Contrast Checker: Contrast ratio of text on a background, against WCAG AA and AAA.
Favicon Generator: Every favicon size from one image.
Image Compressor: Shrink a JPEG, PNG or WebP in the browser.
Gradient Generator: Build a CSS gradient and copy the rule.
Box Shadow Generator: Tune a shadow and copy the CSS.

Reference

ASCII Table: Every ASCII character with its decimal, hex, octal, binary and HTML code.
HTTP Status Codes: Every HTTP status code with what it means and when to use it.
MIME Types: Common MIME types by file extension, searchable.
Port Numbers: Well-known and registered TCP and UDP ports and the services behind them.