Hash generator

Known digests you can trust

Hash functions are deterministic. If this page disagrees with OpenSSL on these vectors, something is wrong. Input is UTF-8 text with no trailing newline unless you type one.

Full hex for hello under SHA-256 is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Paste hello, leave SHA-256 and Hex selected, hit Hash, and match that string.

Pick the algorithm for the job

SHA-256 is the default for new integrity checks, content-addressed blobs, and most modern digests. Prefer it unless a protocol names something else.

SHA-1 still shows up in git object IDs (legacy), some package manifests, and older TLS fingerprints. Collision attacks make it unsafe for new security designs. Keep it here for matching what a system already printed.

MD5 is broken for collision resistance. Use it only to verify an old file checksum or a legacy fingerprint someone already published. Do not invent new MD5-based trust.

Hex vs Base64 is packaging, not hashing

The digest bytes are the same either way. Hex is longer and easy to diff by eye. Base64 is shorter and common in headers or JSON. Switching Output does not re-hash; this page re-encodes the same bytes when you Hash again after changing the format.

Encoding note: input is always UTF-8 via TextEncoder. A trailing newline you type is part of the message. That is why "hello" and "hello\\n" digests differ.

Hard stops

• Not a password hasher. No salt, no slow KDF, no pepper. For storing secrets use Argon2, bcrypt, scrypt, or your framework helper.
• No HMAC / keyed digest UI. If you need a MAC, use a dedicated library with a secret key you control.
• No file drop zone on this page. Paste text (or small snippets). Huge blobs belong in a CLI.
• MD5 and SHA-1 are offered for compatibility, not as recommendations for new security.

SHA-256, SHA-1 and MD5 in code

Each snippet hashes the text hello so you can check it against this page: SHA-256 and SHA-1 in hex, MD5 in Base64.

JavaScript: node:crypto and Web Crypto

import { createHash } from "node:crypto"; // Node.js, built in

const text = "hello";
console.log(createHash("sha256").update(text, "utf8").digest("hex"));
console.log(createHash("sha1").update(text, "utf8").digest("hex"));
console.log(createHash("md5").update(text, "utf8").digest("base64"));

// In the browser, Web Crypto does SHA-1 and SHA-256 (not MD5):
const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
console.log([...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join(""));

Python: hashlib

import base64, hashlib

data = "hello".encode("utf-8")
print(hashlib.sha256(data).hexdigest())
print(hashlib.sha1(data).hexdigest())
print(base64.b64encode(hashlib.md5(data).digest()).decode())

# Files: hash in chunks instead of reading everything into memory
# with open("big.iso", "rb") as f:
#     print(hashlib.file_digest(f, "sha256").hexdigest())  # Python 3.11+

Go: crypto/sha256, crypto/sha1, crypto/md5

package main

import (
	"crypto/md5"
	"crypto/sha1"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
)

func main() {
	data := []byte("hello")
	fmt.Printf("%x\n", sha256.Sum256(data))
	fmt.Printf("%x\n", sha1.Sum(data))
	sum := md5.Sum(data)
	fmt.Println(base64.StdEncoding.EncodeToString(sum[:]))
}

Each snippet was run on October 14, 2026 with Node.js 20, Python 3.14 and Go 1.24.

Hash algorithm standards

• NIST FIPS 180-4: Secure Hash Standard: defines SHA-1 and the SHA-2 family, including SHA-256
• RFC 1321: The MD5 Message-Digest Algorithm
• RFC 6151: security considerations for MD5: why MD5 is unsafe for signatures
• NIST retires SHA-1 (2022)
• W3C Web Cryptography API: digest()
• Python docs: hashlib
• Node.js docs: crypto.createHash

FAQ