HandyTools Hub

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 hashes for text.

Select Algorithms

Input

Output Options

Hash Comparison

Verify a hash by comparing it with the generated hash.

A hash generator turns any text into a fixed-length fingerprint using MD5, SHA-1, SHA-256, and SHA-512. This tool computes all four at once, in real time as you type, entirely in your browser. Use it to confirm two pieces of data are identical, to compute a checksum before publishing a file, to reproduce a signature during integration testing, or to see how a value will appear once hashed.

How to Use

  1. Enter text into the input field. Every keystroke recomputes all enabled algorithms, so there is no submit step.
  2. Select the algorithms you care about: MD5, SHA-1, SHA-256, and SHA-512 can be enabled individually or together.
  3. Compare the digests. The tool displays each hash in hexadecimal, the conventional representation for 128-, 160-, 256-, and 512-bit outputs.
  4. Copy the one you need with a single click. To start fresh, clear the field — no data is retained.

Worked Examples

Example 1 — verifying a download. A vendor publishes SHA256SUMS next to a release file. You download the file, run sha256sum locally, and compare with the published value. If a single byte changed in transit — corruption or tampering — the hashes differ completely. Pasting a short sample into the tool is a quick way to confirm you are comparing the right length of string, though a full ISO should be checked with the command-line tool.

Example 2 — comparing two payloads. Two API responses look identical in a diff viewer that is hiding whitespace. Hash both and compare: if the SHA-256 values match, the payloads are byte-for-byte identical; if they differ, something changed. It is a five-second check that beats scrolling through a thousand lines.

Example 3 — the avalanche effect. Type hello, note the SHA-256 digest, then capitalize the H and watch it change entirely. There is no shared prefix or suffix. This property is what lets a small checksum stand for an entire document.

How Hash Functions Work

A cryptographic hash function has four defining properties:

  • Deterministic — the same input always produces the same digest.
  • Fixed length — MD5 outputs 128 bits, SHA-1 160, SHA-256 256, SHA-512 512, regardless of input size.
  • One-way — given only the digest, there is no practical way to recover the input.
  • Avalanche effect — flipping one input bit changes about half the output bits.

Because the output space is finite, collisions (two inputs with the same hash) must exist. What separates a secure algorithm from a broken one is whether collisions can be constructed on purpose. MD5 collisions became practical in 2004 and SHA-1 in 2017, which is why neither is trusted for signatures or certificates today. SHA-2 (SHA-256, SHA-512) remains unbroken after two decades of scrutiny.

Choosing an Algorithm

  • MD5 / SHA-1 — for integrity checks of data you control, where no adversary is involved. Fast, widely available, but never for security.
  • SHA-256 — the sensible default for checksums, content addressing, and any modern integrity check.
  • SHA-512 — same family, longer output; common on 64-bit platforms where it is as fast as SHA-256.
  • HMAC-SHA-256 — not a hash variant but a construction that mixes a secret key into the process, used for signed webhooks and API authentication. If your use case is “prove this message came from someone with the key,” plain hashing cannot do it.

Common Mistakes and Edge Cases

  • Calling hashing “encryption.” A hash cannot be reversed; encryption can. If you need the original back, you need encryption, not a hash.
  • Storing passwords with a fast hash. SHA-256 is designed to be fast, which helps attackers guessing billions of candidates per second. Password storage needs a deliberately slow, salted algorithm such as Argon2id, bcrypt, or scrypt — never raw MD5/SHA.
  • Trusting a checksum from the same page as the download. It still catches transit corruption, but not a compromised site.
  • Forgetting trailing newlines. hello and hello\n hash completely differently. If two values should match but do not, check for an invisible newline or trailing space.
  • Mixing encodings. Hashing a UTF-8 string and a UTF-16 string with the same visible characters yields different digests; make sure both sides agree on the byte encoding.
  • Using MD5 for signatures. Broken collisions mean an attacker can craft a malicious file that shares a trusted MD5. Use SHA-256 or better.

Features

  • Computes MD5, SHA-1, SHA-256, and SHA-512 simultaneously
  • Real-time results as you type, with hexadecimal output
  • One-click copy for each digest
  • Works offline with no uploads or accounts
  • 100% client-side — input never leaves the browser

Use Cases

  • File verification: Compare a download against a published checksum.
  • Data comparison: Confirm two payloads, exports, or configs are identical.
  • API signing: Reproduce the HMAC or digest an integration expects.
  • Development and testing: Generate deterministic fixtures and cache keys.
  • Change detection: Snapshot a document’s hash to spot later edits.

Frequently Asked Questions

Why do 'hello' and 'Hello' produce completely different hashes?

Cryptographic hash functions exhibit the avalanche effect: changing a single bit of input changes roughly half of the output bits, with no visible relationship between the two digests. That is what makes hashes useful for detecting any change, even a one-character edit. 'hello' and 'Hello' differ in one bit, so their SHA-256 values share no prefix at all.

Should I use MD5 or SHA-1 for file checksums?

For files you control and download from a trusted source, MD5 and SHA-1 still detect accidental corruption, which is their common use. But both are broken for security: practical MD5 collisions appeared in 2004 and a SHA-1 collision in 2017, so they cannot prove authenticity. Prefer SHA-256 — it costs almost nothing and removes the debate. Verify against the vendor's published checksum, not one from the same page as the download.

What is the difference between SHA-256 and HMAC-SHA-256?

SHA-256 has no key, so anyone can compute it. HMAC-SHA-256 mixes a secret key into the hash, so only someone holding the key can produce the same value. Use plain hashing for integrity checks, and HMAC for authenticating messages such as webhook payloads or signed API requests.

Why is 'same hash length' a problem?

Hashes map an infinite set of inputs to a finite set of outputs, so collisions must exist. For a healthy algorithm they are impractical to find — roughly one in 2^128 for SHA-256. Historically broken algorithms are those where researchers learned to construct collisions deliberately, which is why MD5 and SHA-1 were retired from security work.

Does hashing here support binary files?

This tool hashes text you paste or type. To verify a downloaded file, compute its hash with a command-line tool — sha256sum on Linux/macOS, certutil -hashfile on Windows — and compare the result with the vendor's published value, character by character.

Is the input sent to a server?

No. Hashing runs entirely in your browser with JavaScript, and the field is cleared by simply reloading the page. Nothing is transmitted or logged, which makes it safe for input values you would not paste into a third-party service.

Reviewed by the HandyTools Hub team · Last updated