Quackyard
  • Loading…

Hash Generator

Hash text with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, and check a hash against it.

Nothing leaves your browser: every digest is worked out here, in the page.

Case and spaces are ignored, so a hash from a checksum file goes straight in.

Hashing the 43 bytes of UTF-8 text.

AlgorithmDigestCopy
MD5 · 128 bits · broken9e107d9d372bb6826bd81d3542a419d6
SHA-1 · 160 bits · broken2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
SHA-256 · 256 bitsd7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
SHA-384 · 384 bitsca737f1014a48f4c0b6dd43cb177b0afd9e5169367544c494011e3317dbf9a509cb1e5dc1e85a941bbee3d7f2afbc9b1
SHA-512 · 512 bits07e547d9586f6a73f73fbac0435ed76951218fb7d0c8d788a309d785436bbb642e93a252a954f23912547d1e8a3b5ed6e1bfd7097821233fa0538f3db854fee6

MD5 and SHA-1 are broken: collisions can be built on purpose, so a digest that matches proves nothing about who wrote a file. Use SHA-256 to check a file you downloaded. For passwords, use neither: bcrypt or Argon2 is slow on purpose and salts every hash, so a stolen list can’t be cracked in bulk.

Runs in your browser. Nothing you enter is sent anywhere.

How to use it

Type or paste into the Text box. All five digests appear as you type, worked out in the page, so nothing you paste is uploaded. Each row has its own copy button.

  1. Choose what the box holds. Text (UTF-8) hashes the text’s UTF-8 bytes, which is what every other tool means by “the hash of” a string. Hex bytes reads the box as hex and hashes the bytes it spells, for data that isn’t text; spaces, line breaks and one leading 0x are skipped.
  2. To check a hash, paste it into Compare with a hash. Case and spaces are ignored. The page names the matching algorithm (The input’s SHA-256 digest, character for character.) and highlights its row, or says None of the five algorithms produces that hash for this input.

The line above the table says how many bytes were hashed. MD5 and SHA-1 are marked broken.

Examples

The text hello, with Text (UTF-8):

MD5      5d41402abc4b2a76b9719d911017c592
SHA-1    aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-256  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-384  59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f
SHA-512  9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043

The same hello compared with the hash from echo hello | sha256sum:

5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03

The result is None of the five algorithms produces that hash for this input. echo adds a line break, so the shell hashed 6 bytes. Press Enter after hello in the box and SHA-256 matches.

The bytes 68 65 6c 6c 6f with Hex bytes, spaces and all, are the five bytes of hello, so the SHA-256 is again 2cf24dba5fb0a30e…938b9824. With Text (UTF-8), the same 14 characters hash to b00ffab6169cf341f5a6306a650eace98601bb1adcb78c1de4631956b4171642.

A line of hexdump -C output, with Hex bytes:

00000000  68 65 6c 6c 6f                                    |hello|

It’s rejected with Character 61 is "|", which isn't a hex digit. Hex reads 0-9 and a-f, either case, two digits to a byte. Its text column isn’t hex, and its offset would be hashed too. Paste xxd -p output instead: it holds only the digits.

Good to know

  • A hash is of bytes, not characters. café is 5 bytes in UTF-8, so its digest differs from a tool that uses Latin-1 or UTF-16.
  • The digest length tells you the algorithm. In hex, MD5 is 32 characters, SHA-1 40, SHA-256 64, SHA-384 96 and SHA-512 128. Compare with a hash checks all five.
  • Some formats add a prefix or use Base64. Docker image digests read sha256:…, so drop the prefix before comparing. Subresource Integrity hashes (integrity="sha384-…") are Base64, not hex, so they won’t match here as written.
  • The empty input has a digest too. SHA-256 of zero bytes is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 and MD5 is d41d8cd98f00b204e9800998ecf8427e. Seeing either in a log usually means an empty file or a failed download.
  • MD5 and SHA-1 are broken for security. Practical MD5 collisions were published in 2004 and the first SHA-1 collision, SHAttered, in 2017, so a matching digest doesn’t prove a file wasn’t swapped by someone who prepared both. They still catch accidental corruption. SHA-256, SHA-384 and SHA-512 are the SHA-2 family from FIPS 180-4; SHA-384 is SHA-512 with different starting values, cut to 384 bits.
  • Never store passwords as plain hashes. They’re fast by design, so leaked SHA-256 password hashes can be guessed in bulk; bcrypt and Argon2 are slow on purpose and salt every hash.
  • Hex bytes skips whitespace. Spaces, tabs, line breaks and one leading 0x are ignored, so wrapped xxd -p output pastes as it is. Other characters, 0x before every byte included, are rejected with their position, as is an odd number of digits. Input is limited to 100,000 characters.

Questions

How do I generate a SHA-256 hash of a string?

Type the string into Text and copy the SHA-256 row. In a shell, printf '%s' 'hello' | sha256sum on Linux or shasum -a 256 on macOS; use printf, not echo, so no line break is added. In a browser, crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)) returns the digest as an ArrayBuffer.

Why doesn’t my hash match the one from another tool?

Almost always because the bytes differ, not the algorithm: a trailing line break from echo or a text editor, CRLF instead of LF line endings, a leading space, or a different text encoding. Paste the other tool’s hash into Compare with a hash and adjust the input until a row lights up.

Can an MD5 or SHA-256 hash be reversed?

No: a hash is one-way, and many inputs map to each digest. Short or common inputs can still be found by guessing or with precomputed tables, so a hash of a password or a phone number protects very little.

How do I check a downloaded file’s checksum?

Hash the file locally and compare it with the published value: sha256sum file.iso on Linux, shasum -a 256 file.iso on macOS, or Get-FileHash file.iso in PowerShell (SHA-256 by default). This page hashes text or hex, not files.

Common answers