Free Online Hash Generator (MD5, SHA-1, SHA-256, SHA-512)

They're all hash functions that turn input text into a fixed-length fingerprint, but they differ in output length and security. MD5 (128-bit) and SHA-1 (160-bit) are fast and short but cryptographically broken — fine for non-security checksums, but never for anything security-sensitive. SHA-256 (256-bit) is the modern standard for security use: TLS certificates, Git commit IDs, JWTs, blockchain. SHA-512 (512-bit) offers extra headroom for long-term integrity checks. If you're not sure, use SHA-256.

Yes, both are considered cryptographically broken. Researchers have demonstrated practical collision attacks — two different inputs that produce the same hash — against both MD5 and SHA-1, which defeats the core guarantee a security hash is supposed to provide. They're still fine for non-adversarial uses like file checksums or cache keys, but should never be relied on where an attacker could deliberately craft a colliding input.

Good uses include verifying file integrity (checksums), Git commit IDs, generating deterministic cache keys, and detecting duplicate content. A hash function should NOT be used to store passwords directly — general-purpose hashes like MD5/SHA-256 are designed to be fast, which makes them easy to brute-force. For password storage, use a purpose-built slow hashing algorithm like bcrypt, scrypt, or Argon2 instead.

Yes. Every hash is computed entirely inside your browser. SHA-1, SHA-256, and SHA-512 use the built-in Web Crypto SubtleCrypto API; MD5 (which SubtleCrypto doesn't support) uses a small pure-JavaScript implementation. Nothing you type is uploaded, logged, or transmitted to a server — you can disconnect from the internet after the page loads and it will keep working.

Yes. Input is encoded as UTF-8 before hashing (via TextEncoder), so Chinese characters, emoji, and any other Unicode text hash correctly and consistently with standard hashing libraries in other languages.

This tool hashes text you paste in, not files directly. To verify a downloaded file, compute its hash with a command-line tool (certutil -hashfile on Windows, shasum -a 256 on Mac, sha256sum on Linux) and compare the result against the checksum the publisher provided.