What Is a Cryptographic Hash?
A hash function maps input of any length to a fixed-length fingerprint. Change one character of the input and the digest changes unpredictably. That property makes hashes useful for checksums, cache keys, deduplication, and verifying that a downloaded file matches a published digest.
Hash Generator displays four widely referenced algorithms side by side so you can match whatever format a README, API spec, or legacy system expects.
Algorithms in This Tool
| Algorithm | Digest size | Typical use today | |-----------|-------------|-------------------| | MD5 | 128 bits (32 hex chars) | Legacy checksums — avoid for security | | SHA-1 | 160 bits (40 hex chars) | Deprecated for TLS and signatures — legacy Git uses it | | SHA-256 | 256 bits (64 hex chars) | Modern integrity checks, blockchain, certificates | | SHA-512 | 512 bits (128 hex chars) | Higher security margin where longer digests are specified |
MD5 uses the SparkMD5 library. SHA-1, SHA-256, and SHA-512 use crypto.subtle.digest from the Web Cryptography API.
Security Limitations You Should Know
MD5 and SHA-1 are not safe against intentional collision attacks. Researchers can craft two different files with the same MD5 hash. Do not rely on them to prove authenticity against motivated adversaries.
Even SHA-256 is wrong for password storage. Hashing is fast — attackers can test billions of guesses per second on GPUs. Password systems need deliberately slow functions with unique salts per user.
Use this tool for debugging, interoperability checks, and non-adversarial fingerprinting — not for designing new security mechanisms.
Text Input vs. File Checksums
Publishing sites often list SHA-256 checksums for downloadable binaries. Those hashes cover raw file bytes. Pasting file contents as text here hashes the UTF-8 interpretation of that text, which differs from hashing the binary stream unless you hex-encode the file first.
For document verification workflows, confirm whether the reference digest was computed over binary content or a canonical string representation.
Verifying a Known Digest
To check a password or API secret against a stored hash outside this tool, hash your candidate input here and compare strings. For salted password hashes (bcrypt strings starting with $2), this tool is not applicable — those formats embed salt and cost parameters requiring specialized verification libraries.
For cache keys and ETag-style fingerprints in application code, paste representative JSON or URL strings here during development to preview what your server-side hash('sha256', ...) call should return — again, mind encoding and trailing newline differences.