Hash generator

Digest UTF-8 text with SHA-256, SHA-1, or MD5. Copy hex or Base64. Runs only in this tab.

Handy when you need a quick checksum, a content fingerprint, or a known test vector without installing OpenSSL.

Client-side only. SHA-256 and SHA-1 use SubtleCrypto. MD5 is a local JS routine. Nothing is uploaded.

Algorithm

Output

Input text

Digest

Known digests you can trust

Hash functions are deterministic. If this page disagrees with OpenSSL on these vectors, something is wrong. Input is UTF-8 text with no trailing newline unless you type one.

Input	Algorithm	Hex digest (prefix)
`(empty)`	SHA-256	`e3b0c44298fc1c14...`
`hello`	SHA-256	`2cf24dba5fb0a30e...`
`hello`	SHA-1	`aaf4c61ddcc5e8a2...`
`hello`	MD5	`5d41402abc4b2a76...`

Full hex for hello under SHA-256 is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Paste hello, leave SHA-256 and Hex selected, hit Hash, and match that string.

Pick the algorithm for the job

SHA-256 is the default for new integrity checks, content-addressed blobs, and most modern digests. Prefer it unless a protocol names something else.

SHA-1 still shows up in git object IDs (legacy), some package manifests, and older TLS fingerprints. Collision attacks make it unsafe for new security designs. Keep it here for matching what a system already printed.

MD5 is broken for collision resistance. Use it only to verify an old file checksum or a legacy fingerprint someone already published. Do not invent new MD5-based trust.

Hex vs Base64 is packaging, not hashing

The digest bytes are the same either way. Hex is longer and easy to diff by eye. Base64 is shorter and common in headers or JSON. Switching Output does not re-hash; this page re-encodes the same bytes when you Hash again after changing the format.

Encoding note: input is always UTF-8 via TextEncoder. A trailing newline you type is part of the message. That is why "hello" and "hello\\n" digests differ.

Hard stops

Not a password hasher. No salt, no slow KDF, no pepper. For storing secrets use Argon2, bcrypt, scrypt, or your framework helper.
No HMAC / keyed digest UI. If you need a MAC, use a dedicated library with a secret key you control.
No file drop zone on this page. Paste text (or small snippets). Huge blobs belong in a CLI.
MD5 and SHA-1 are offered for compatibility, not as recommendations for new security.

FAQ

Does this hash generator upload my text?

No. SHA-256 and SHA-1 use the Web Crypto SubtleCrypto API in this tab. MD5 uses a small local JavaScript implementation. ToolPetal has no backend for hashing.

Which algorithm should I pick?

Use SHA-256 for new integrity checks and digests. Use SHA-1 only when a legacy protocol still demands it. Use MD5 only for matching old checksums or non-security fingerprints. None of these alone are a password storage scheme.

Why does the empty string still produce a hash?

Hash functions are defined for every byte length, including zero. The empty input has a fixed digest per algorithm. That is useful as a known test vector, not a bug.

Is this safe for hashing passwords?

No. Raw MD5, SHA-1, or SHA-256 without a slow KDF and a unique salt is the wrong tool for password storage. Use bcrypt, scrypt, Argon2, or your platform password hasher instead.