Corvo

Security

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or a file — all computed locally, using your browser’s own cryptographic engine where possible.

Runs entirely in your browser. Nothing is uploaded.

Input
MD5 Waiting for input
SHA-1 Waiting for input
SHA-256 Waiting for input
SHA-384 Waiting for input
SHA-512 Waiting for input
Waiting for input

What this tool does

Computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or a file — all five at once, entirely in your browser. Paste text or drop in a file, and every hash updates automatically.

The SHA family is computed using your browser's own built-in cryptographic engine (crypto.subtle), the same primitive real security software relies on. MD5 isn't part of that browser API — no browser ships a native MD5 function, since it's considered obsolete for anything security-sensitive — so it runs as a plain JavaScript implementation instead, verified against the official published test vectors before ever going into this page.

How to use it

  1. Switch between Text and File depending on what you're hashing.
  2. Type, paste, or drop in your input — every algorithm computes automatically.
  3. Copy whichever hash you need with its own Copy button.
  4. Turn on Uppercase if the system you're comparing against expects that format.

What a hash is actually useful for

A cryptographic hash takes any input and produces a fixed-length fingerprint — the same input always produces the same hash, and changing even one character produces a completely different one. That makes hashes useful for exactly one kind of question: "is this the exact same data as before?" — verifying a downloaded file matches the checksum the publisher posted, confirming two files are byte-for-byte identical, or checking that a piece of text hasn't been altered.

A hash is not encryption — there's no way to reverse it back to the original input, and that's by design. It's also not a substitute for authentication or password storage, which need different tools built for that specific job (see the FAQ below).

Choosing an algorithm

SHA-256 is the right default for nearly everything today — it's fast, well supported everywhere, and has no known practical weaknesses. SHA-384 and SHA-512 exist for situations that specifically call for a longer digest. MD5 and SHA-1 are both considered broken for security purposes (each has known collision attacks), but remain common for checksums and compatibility with older tools and systems that still expect them.

Questions

Is this Hash Generator free?

Yes, completely, with no signup and no limit on how much you hash.

Is my data uploaded anywhere?

No. Every hash — text or file — is computed entirely in your browser. Nothing is sent to a server; you can confirm this yourself by watching your browser's Network tab while using the tool.

Why offer MD5 at all if it's insecure?

Because most real uses of MD5 today have nothing to do with security. It's still the standard checksum for verifying a file downloaded correctly, checking two files are identical, or matching against an older system that already uses it. What MD5 (and, increasingly, SHA-1) should not be used for is anything security-sensitive — passwords, signatures, or anywhere someone might deliberately try to produce a collision. For that, SHA-256 or better is the right call.

Which algorithm should I actually use?

SHA-256 is the sensible default for most modern purposes — checksums, verifying data integrity, general-purpose hashing. Reach for SHA-384 or SHA-512 where a longer digest is specifically required. MD5 and SHA-1 are mainly useful for compatibility with older systems or tools that still expect them.

Is this the right tool for hashing passwords?

No — and this is worth being direct about. None of the algorithms here (MD5, SHA-1, or the SHA-2 family) are designed for storing passwords, because they're deliberately fast, which makes them practical to brute-force at scale. Real password storage needs a slow, purpose-built algorithm — bcrypt, scrypt, or Argon2 — which intentionally takes longer to compute specifically to make large-scale guessing impractical. Use this tool for checksums and integrity verification, not for hashing anything security-sensitive.

Why do SHA-1 and MD5 sometimes take a moment longer than SHA-256?

They usually don't — if anything, SHA-256 and the others run through your browser's own optimized cryptographic engine. MD5 here is a plain JavaScript implementation (no browser ships a native MD5 function, since it's considered obsolete for security purposes), so on a very large file it can be the slowest of the five, though still fast enough for anything reasonably sized.

Related tools