Hash Generator

How it works

A hash function takes any sequence of bytes and returns a fixed-size value, the digest. The same bytes always give the same digest, and a change of even one byte gives an unrelated-looking one. There is no key and no secret, so there is also nothing to decode: a digest cannot be turned back into the input.

The page turns your text into bytes (UTF-8, see below), hashes those bytes with five algorithms at once and shows each result as hex or Base64.

How each is computed. Web Crypto does not offer MD5, so it is implemented in this page's code following RFC 1321: padding as in sections 3.1 and 3.2, 64 steps in four rounds as in section 3.4, with the constants derived from the sine function. The implementation is checked against the RFC's own test suite (appendix A.5) and against Node's MD5 on inputs around every padding boundary. SHA-1, SHA-256, SHA-384 and SHA-512 (FIPS 180-4) come from the browser's crypto.subtle.digest. Web Crypto is only available on secure pages (HTTPS) and is missing from very old browsers; where it is unavailable, the SHA rows say so and MD5 still works.

Text becomes bytes as UTF-8. Letters outside ASCII take more than one byte, and the digest depends on the exact bytes. The page does not trim whitespace, change line endings or apply Unicode normalization. A single unpaired surrogate cannot be written in UTF-8 and is replaced with U+FFFD before hashing.

Output. Hex is lowercase by default, with an uppercase option. Base64 is RFC 4648 section 4, with padding, of the raw digest bytes. Empty text is valid and gives the hash of zero bytes. Input can be up to 500,000 characters.

Examples

All values below are asserted in the tool's tests.

The MD5 rows are entries of the RFC 1321 test suite; the suite has seven, and the other two (the 62-character letters-and-digits string and the 80-digit string) are tested too. The tests also include the SHA-384 and SHA-512 hashes of abc.

One digest, two spellings. MD5 of abc is 900150983cd24fb0d6963f7d28e17f72 in lowercase hex, 900150983CD24FB0D6963F7D28E17F72 in uppercase hex and kAFQmDzST7DWlj99KOF/cg== in Base64. They are the same 16 bytes.

Why byte counts matter. The text ş is 2 bytes in UTF-8, not 1. The test string şğüİıß 😀 is six two-byte letters, a one-byte space and a four-byte emoji: 17 bytes, which is the number the Input size line shows. The same text in UTF-16 or Latin-1 would be a different byte sequence and a different hash.

Invisible differences. a + line feed + b is 3 bytes. With a carriage return before the line feed (Windows line ending) it is 4 bytes, and with a newline added at the end it is also 4 bytes. All three give different SHA-256 hashes. In the same way, é as one code point is 2 bytes and e followed by a combining accent (U+0301) is 3, so they hash differently even though they look identical.

Things to watch for

• A hash is not encryption. Anything that offers to "decode" or "decrypt" an MD5 can only compare the hash against the hashes of texts already known; it does not reverse anything. If you need to hide data and get it back, you need real encryption, which is a different thing.
• Do not use MD5 or SHA-1 where an attacker could benefit. Signatures, certificate checks and integrity checks against a malicious party are out. Plain checksums and cache keys are fine.
• Do not store passwords with a fast hash. This is advice, not a feature of this tool: use a dedicated password hashing function, slow and salted by design. SHA-256 and the larger ones are not password hashes either.
• Same-looking text, different hash. Line endings (LF against CRLF), a trailing newline or space and the text encoding all change the result. When a value does not match, compare byte counts first.
• Text only. There is no file mode here. Pasting a binary file into a text box does not preserve its bytes, so the result would not be the file's checksum.
• Compare normalized hex. Uppercase and lowercase hex are the same value, but a string comparison does not know that.
• Privacy. Your text is hashed in your browser and is not sent to a server.