What is the difference between MD5, SHA-1 and SHA-256?

MD5 produces a 32-character hash and is cryptographically broken — avoid for security. SHA-1 produces a 40-character hash and is deprecated for TLS and code signing. SHA-256 is the current standard used in TLS certificates, JWT tokens, and Bitcoin.

Is this hash generator safe to use with sensitive data?

Yes. All hashing is performed locally in your browser using the Web Crypto API (SubtleCrypto for SHA variants, RFC 1321 for MD5). No text is transmitted to any server at any point.

Can I reverse a hash back to the original text?

No. Hash functions are one-way — it is computationally infeasible to reverse a hash to find the original input. This is a fundamental property called pre-image resistance.

What hash algorithm should I use?

Use SHA-256 for most purposes — it is the industry standard for digital signatures, TLS, and API authentication. Use SHA-512 for higher security margin. Avoid MD5 and SHA-1 for anything security-critical.

Hash Generator

Type or paste any text to instantly compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes. All hashing happens locally in your browser.

Input Text

Output

Hashes

MD5 —

SHA-1 —

SHA-256 —

SHA-384 —

SHA-512 —

What Is a Hash Function?

A cryptographic hash function takes an input of any size and produces a fixed-length output (the hash or digest). The same input always produces the same output, but it is computationally infeasible to reverse the process or find two inputs with the same output (collision resistance).

MD5 (128-bit)

MD5 produces a 32-character hex digest. It is fast but cryptographically broken — collisions can be generated in seconds. It should not be used for security purposes. It is still acceptable for checksums and non-security file integrity checks.

SHA-1 (160-bit)

SHA-1 produces a 40-character hex digest. It has been practically broken since 2017 (SHAttered attack) and is deprecated for SSL/TLS, code signing, and digital signatures. Git still uses it internally for commit hashing (being migrated to SHA-256).

SHA-256 (256-bit)

SHA-256 is part of the SHA-2 family and produces a 64-character hex digest. It is the current industry standard — used in TLS certificates, code signing, Bitcoin, JWT tokens (HS256/RS256), and HMAC-SHA256 for API signature verification.

SHA-512 (512-bit)

SHA-512 produces a 128-character hex digest and offers a higher security margin. It is used in password hashing schemes and contexts where a larger digest size is beneficial. On 64-bit CPUs, SHA-512 is often faster than SHA-256.

Common Use Cases

Verifying file integrity — compare hash of a downloaded file against the published checksum
Debugging HMAC signatures for Stripe, GitHub, and other webhook providers
Checking if two files are identical without comparing byte by byte
Generating deterministic IDs from content (content-addressed storage)

Related Developer Tools

Need to decode a JWT that uses HMAC-SHA256 signing? Use the JWT Decoder. For generating cryptographically unique IDs without hashing, try the UUID Generator. To encode data in Base64, use the Base64 Encoder.