Hash Generator
Type or paste text to see its MD5, SHA-1, and SHA-256 hashes, all at once, updated live as you type.
—
—
—
How to use it
- Type or paste any text into the box.
- All three hashes — MD5, SHA-1, SHA-256 — update automatically as you type.
- Click Copy next to any hash to grab it.
- Hashing is one-way: there's no "decode" here, because hashes aren't meant to be reversed.
What's actually happening
SHA-1 and SHA-256 are computed using the browser's built-in crypto.subtle.digest() — the Web Crypto API, the same cryptographically-audited implementation used by browsers for TLS and other security-critical operations. Your text is first converted to UTF-8 bytes, then hashed, then the resulting bytes are formatted as lowercase hexadecimal.
MD5 is not available through Web Crypto — browsers deliberately excluded it because of its known weaknesses — so this tool implements the standard MD5 algorithm (as defined in RFC 1321) directly in JavaScript: padding the message to a multiple of 512 bits, processing it in 64-step rounds using bitwise operations and a table of 64 constants, and producing a 128-bit digest.
Worked example
Hashing the string Hello, DevKit Forge! (try it in the box above) produces:
MD5: (computed live above — updates instantly) SHA-1: (computed live above) SHA-256: (computed live above)
Change even a single character — a comma, a space — and every hash changes completely. That's the avalanche effect: a well-designed hash function produces a wildly different output for even a tiny input change, which is exactly what makes hashes useful for detecting alterations.
Reference: which algorithm for which job
| Use case | Recommended | Why |
|---|---|---|
| File integrity / checksums | SHA-256 (or MD5 for legacy tools) | Fast, and collision resistance matters less for accidental corruption |
| Git commit IDs | SHA-1 (Git's choice, being phased toward SHA-256) | Historical Git design decision, not a security requirement here |
| Password storage | Neither — use bcrypt/scrypt/Argon2 | General hashes are fast, which helps attackers brute-force |
| Digital signatures / certificates | SHA-256 or stronger | MD5 and SHA-1 both have practical collision attacks |
Frequently asked questions
Is MD5 safe to use for passwords?
No. MD5 is cryptographically broken and fast enough that attackers can brute-force short inputs quickly. It's still fine for non-security uses like checksums, but never for passwords or anything requiring collision resistance.
Is SHA-1 still considered secure?
No. SHA-1 has practical collision attacks and is deprecated for security-sensitive use. Use SHA-256 or stronger where collision resistance matters — SHA-1 here is mainly for compatibility with legacy systems.
Should I hash passwords with SHA-256 directly?
No. General-purpose hashes are fast by design, which makes brute-forcing cheap. Passwords should use a dedicated slow, salted algorithm like bcrypt, scrypt, or Argon2.
Why do the same input and different algorithms produce completely different-length output?
Each algorithm has a fixed output size: MD5 is always 128 bits (32 hex chars), SHA-1 always 160 bits (40 hex chars), SHA-256 always 256 bits (64 hex chars) — regardless of input length.
Does this tool hash files or only text?
Only text entered directly. Hashing files needs raw binary data through the File API, a different workflow intentionally out of scope here.
About this tool
d41d8cd98f00b204e9800998ecf8427e). None of these algorithms are suitable for password storage; see the FAQ above.