Skip to main content
Cryptography

Hash Generator

Generate standards-compatible MD5 plus Web Crypto SHA-1, SHA-256, and SHA-512 hexadecimal digests from UTF-8 text entirely in your browser. Useful for verifying file integrity, creating fingerprint identifiers, password storage research, and data deduplication. MD5 is included for legacy compatibility only.

Hashing tools

In brief

Generate interoperable MD5, SHA-1, SHA-256, and SHA-512 digests locally; prefer SHA-256 or SHA-512, and never use fast digests for password storage.

What this tool supports

  • Typed, pasted, or imported text is encoded as UTF-8; files are imported as text rather than hashed as raw bytes.
  • A tested RFC 1321-compatible implementation computes MD5 while SubtleCrypto.digest computes SHA-1, SHA-256, and SHA-512.
  • Lowercase MD5, SHA-1, SHA-256, and SHA-512 rows can be copied singly or together; MD5 and SHA-1 are retained only for legacy interoperability.
  • Use HMAC Generator when a shared secret must authenticate a message, not a plain digest.
  • No. Fast SHA digests lack password-specific salting and work factors; use Argon2id, scrypt, bcrypt, or PBKDF2 as policy requires.

How to use Hash Generator

Complete a verifiable Hash Generator workflow in this browser.

  1. 1

    Step 1

    Provide the exact input

    Typed, pasted, or imported text is encoded as UTF-8; files are imported as text rather than hashed as raw bytes.

  2. 2

    Step 2

    Set the available controls

    No algorithm selector, salt, stream, binary-file, or password-KDF option is provided.

  3. 3

    Step 3

    Run the operation

    The tool encodes the text as UTF-8, computes RFC 1321-compatible MD5 locally, and requests SHA-1, SHA-256, and SHA-512 from SubtleCrypto.digest.

  4. 4

    Step 4

    Verify the result

    For input abc, require SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.

  5. 5

    Step 5

    Continue or export

    Use HMAC Generator when a shared secret must authenticate a message, not a plain digest.

Common mistakes

Comparing this result with a checksum computed over raw file bytes

Consequence: Imported files are decoded as text and re-encoded as UTF-8 before hashing. Binary data, another source encoding, or decoding replacement characters therefore produce different bytes and a different digest.

Fix: Use this workspace for exact text only; compute file checksums with a raw-byte hashing implementation and record the byte-level input contract.

Storing a password as one of these fast digests

Consequence: MD5 and SHA digests have no per-password salt or configurable work factor, so attackers can test guesses at high speed and reuse precomputed data.

Fix: Use a password-hashing construction such as Argon2id, scrypt, bcrypt, or policy-approved PBKDF2 with unique salts and reviewed parameters.

Using MD5 or SHA-1 as proof that data is authentic or collision-resistant.

Consequence: An attacker can exploit known weaknesses; a matching legacy digest alone does not prove authenticity.

Fix: Use SHA-256 or SHA-512 for modern integrity checks and an HMAC or digital signature when authenticity matters.

Best practices

  • For input abc, require SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.
  • Use MD5 only for legacy checksum interoperability; prefer SHA-256 or SHA-512 for new workflows.
  • Record text encoding and exact bytes alongside any published checksum.

Connected workflows

Verify exact UTF-8 bytes before choosing keyed authenticity

Hash GeneratorHMAC Authentication Code Generator

Use HMAC Generator when a shared secret must authenticate a message, not a plain digest.

  1. Confirm that the source contract is text encoded as UTF-8 rather than raw file bytes
  2. Hash a known vector such as abc and compare the complete lowercase SHA-256 value
  3. Use MD5 or SHA-1 only when an identified legacy protocol explicitly requires that algorithm
  4. Move to HMAC or a digital signature when the receiver must verify authenticity

Browser limitations

  • Web Crypto does not expose MD5, so this tool uses a local RFC 1321-compatible implementation for MD5 and Web Crypto for SHA algorithms.
  • Web Crypto digest is non-streaming and needs the full UTF-8 input in memory.
  • SubtleCrypto may be unavailable outside a secure context.

Authoritative resources

Web Cryptography Level 2: SHAPublisher: W3C · Reviewed: 2026-07-26FIPS 180-4: Secure Hash StandardPublisher: NIST · Reviewed: 2026-07-26OWASP Password Storage Cheat SheetPublisher: OWASP · Reviewed: 2026-07-26

Concrete examples

Input
abc
Result
SHA-256: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

This is the standard SHA-256 digest of UTF-8 bytes 61 62 63. The same input also produces the interoperable MD5 value 900150983cd24fb0d6963f7d28e17f72.

Frequently asked questions

Are imported files hashed as raw bytes or decoded text?

Typed, pasted, or imported text is encoded as UTF-8; files are imported as text rather than hashed as raw bytes.

Is the MD5 row actually MD5?

Yes. It implements RFC 1321-compatible MD5 over UTF-8 bytes for legacy checksum interoperability. MD5 is cryptographically broken, so use SHA-256 or SHA-512 for security-sensitive integrity checks.

Can I store passwords with these digests?

No. Fast SHA digests lack password-specific salting and work factors; use Argon2id, scrypt, bcrypt, or PBKDF2 as policy requires.

Which known vector verifies the UTF-8 and SHA-256 path?

For input abc, require SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.

Is the text or any generated digest transmitted?

Text and digest bytes stay in this browser; Web Crypto may require HTTPS. No input is uploaded.

When should I use HMAC instead of a plain digest?

Use HMAC Generator when a shared secret must authenticate a message, not a plain digest.

Privacy and offline behavior

Text and digest bytes stay in this browser; Web Crypto may require HTTPS. No input is uploaded.