Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from string.
About Online Hash Generator
A cryptographic hash reduces any amount of input to a fixed-length fingerprint. Change one bit of the input and roughly half the output bits flip, which is what makes a digest useful for spotting that two things differ without having to compare them in full. Type in the box above and all five digests update as you go.
What the tool hashes
The text in the box is encoded as UTF-8 and those bytes are fed to each algorithm, so results line up with sha256sum, openssl dgst, Python's hashlib and Java's MessageDigest given the same bytes. Non-ASCII input is where implementations diverge in practice: a system that encodes as UTF-16 or Latin-1 will produce a completely different digest for the same visible characters, so if you are chasing a mismatch involving accented or CJK text, check the encoding before you suspect the algorithm.
Choosing between the five
SHA-256 is the sensible default and the one most modern protocols expect. SHA-512 is not meaningfully more secure for ordinary use but is often faster on 64-bit hardware, and it is what you want when a longer digest is specified. MD5 and SHA-1 are here because the world still publishes them — mirror checksums, legacy APIs, Git object IDs — not because they should be chosen for new work. RIPEMD-160 is a niche entry kept for Bitcoin and older PGP workflows.
Reading a digest correctly
Two identical hashes mean the inputs were byte-identical. Two different hashes tell you the inputs differed, but nothing about how much or where — there is no partial match and no notion of similarity, so a single stray space and a completely rewritten document look equally unrelated. Comparing digests by eye is also error-prone; check the first and last several characters at minimum, or paste both into a diff.
Related tools on this site
Verifying a downloaded ISO or archive against a published checksum is a job for the File Checksum Generator, which reads the file itself rather than a pasted transcription of it. Storing user passwords calls for the Bcrypt Generator. And if you need to make a value unreadable rather than unforgeable, hashing is the wrong primitive entirely — Encrypt Text is reversible with the right passphrase, which is usually what people actually want.
Five Digests At Once
MD5, SHA-1, SHA-256, SHA-512 and RIPEMD-160 are recomputed on every keystroke, so you can compare a value against a checksum without first knowing which algorithm produced it.
Matches Your Command Line
Input is hashed as UTF-8 bytes, so SHA-256 of "abc" gives ba7816bf…f20015ad here and from sha256sum, OpenSSL or hashlib alike.
Typed Text Only, Nothing Stored
The page hashes whatever is in the box, in the tab, with no upload and no history. It is deliberately a text tool — files belong in the File Checksum Generator.
Frequently Asked Questions
How long should each digest be?
The lengths are fixed and are a quick sanity check on any hash you are handed. MD5 is 32 hexadecimal characters, SHA-1 and RIPEMD-160 are 40, SHA-256 is 64 and SHA-512 is 128. A 64-character value is therefore almost certainly SHA-256, while a 40-character one is ambiguous between SHA-1 and RIPEMD-160 and you may have to try both.
Why does my hash not match the one from my terminal?
Almost always because the bytes differ, not the algorithm. The classic cause is a trailing newline: echo appends one, so echo hello | md5sum hashes six bytes while this box hashes five. Use printf %s hello instead. The other frequent culprits are Windows CRLF line endings where the original had bare LF, a UTF-8 byte-order mark at the start of a copied file, and an accidental leading or trailing space.
Are MD5 and SHA-1 safe to use?
Not where an adversary is involved. Practical MD5 collisions have existed since 2004 and SHA-1 fell to the SHAttered attack in 2017, so neither should back a signature, a certificate or a download whose integrity someone might want to subvert. Both remain perfectly reasonable as non-adversarial fingerprints — cache keys, ETags, deduplication, spotting whether two config files drifted — and they are still what many legacy systems publish.
Can I hash a password with this?
You can compute the digest, but do not store it. A raw SHA-256 is fast by design, which means a GPU can test billions of guesses per second against a stolen table, and identical passwords produce identical hashes so one cracked entry exposes every user who chose the same one. Password storage needs a slow, salted function: use the Bcrypt Generator, or Argon2id in new code.
What is RIPEMD-160 doing in this list?
It is a 1996 European design that has stayed out of the mainstream, but it is the second hash in Bitcoin address derivation, where a public key is put through SHA-256 and then RIPEMD-160 to reach the 20-byte HASH160. If you are working with cryptocurrency addresses or older PGP tooling you will meet it; otherwise you can ignore that row.
Does this support HMAC, a salt, or file hashing?
None of the three. There is no key input, so you cannot produce the HMAC-SHA256 signature that webhook providers such as Stripe and GitHub ask you to verify; that needs a shared secret and a separate construction. There is no salt field either, and no file picker — hashing a file means reading its raw bytes, which the File Checksum Generator does.