Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text at once, or add a key to get HMAC values. Everything runs in your browser.

Output

HMAC key

Leave the HMAC key empty for plain hashes. Add a key to compute an HMAC instead.

Text

0 B as UTF-8. Text is hashed as its UTF-8 bytes.

Hashes

Computing…

How to use Hash Generator

Type or paste text. All five hashes update as you type.
Choose lowercase hex, uppercase hex or Base64 for the output.
To compute an HMAC, enter a secret key. Every value then becomes a keyed hash of the text.
Copy the hash you need with its Copy button. Press Example to see the hashes of a well-known sentence.

Example

The hashes of a sentence that is used as a test vector in many references. You can paste it and compare.

Text: "The quick brown fox jumps over the lazy dog"

MD5      9e107d9d372bb6826bd81d3542a419d6
SHA-1    2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
SHA-256  d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

About this tool

A hash function turns any amount of data into a short fixed-size fingerprint. The same input always gives the same hash, a tiny change gives a completely different one, and the original cannot be recovered from the hash. They are used for checksums, for detecting changes, for identifying content and as building blocks of signatures.

The text is first converted to UTF-8 bytes, which is what other tools and programming languages hash too. Because of this, the result for plain ASCII text matches the command line, as long as you do not add a trailing newline: echo adds one, which changes the hash. SHA-1, SHA-256, SHA-384 and SHA-512 are computed with your browser's Web Crypto implementation, and MD5 with a tested implementation of RFC 1321, because browsers deliberately do not offer it.

MD5 and SHA-1 are marked in the results because both are broken for security uses: collisions can be produced on purpose. They remain fine for non-adversarial checksums. For anything security-related use SHA-256 or stronger, and never hash passwords with any of these functions: use bcrypt, scrypt, Argon2 or PBKDF2, which are designed to be slow.

The algorithms

Algorithm	Output size	Hex length	Status
MD5	128 bits	32 characters	Broken: use only for checksums
SHA-1	160 bits	40 characters	Deprecated: collisions are practical
SHA-256	256 bits	64 characters	Secure, the common default
SHA-384	384 bits	96 characters	Secure
SHA-512	512 bits	128 characters	Secure, often faster on 64-bit CPUs

Frequently asked questions

Can I use SHA-256 to store passwords?

No. General-purpose hashes are built to be fast, which lets an attacker test billions of guesses per second. Store passwords with a slow, salted algorithm such as Argon2, bcrypt, scrypt or PBKDF2.

Can a hash be reversed?

Not by computation, but short or common inputs can be found by trying them, which is what lookup tables do. That is why a hash of a weak password is not protection.

What is an HMAC?

A hash computed with a secret key, defined in RFC 2104. Only someone with the key can produce or check it, so it proves both that the data is unchanged and that it came from a holder of the key. It is used to sign API requests and webhooks.

Why does my result differ from sha256sum on a file?

This tool hashes the text you type, as UTF-8. A file may have a trailing newline, Windows line endings or a different encoding, each of which changes the hash. To hash a file exactly, use a command-line tool.

Is my text uploaded?

No. All hashing happens in your browser, so text containing secrets stays on your device. Texts of up to 5 million characters are accepted.