To create an MD5 hash, type or paste your text into the Text Input box. With Live hash while typing switched on, the MD5, SHA-1 and SHA-256 hashes appear straight away in All Generated Hashes. Set Primary Output to MD5 to show it in the main box, or select Generate hashes if live hashing is off.
How to use the MD5 hash generator
- Enter your text. Type or paste it into Text Input, or select Choose file under Hash a file to hash any file, such as a download, an image or a ZIP.
- Pick the main output. Primary Output starts on SHA-256, so the page works as a SHA256 hash generator straight away. Switch it to MD5, SHA-1 or All Hashes. All three hashes are always listed below with their own Copy buttons.
- Adjust the input rules. Tick Trim input before hashing to ignore leading and trailing spaces, untick Lowercase output for uppercase hex, or tick Generate hash for empty string.
- Compare or save. Paste a known value into the Hash Compare Checker, choose which algorithm to compare against, then copy the hashes or select Download .txt.
MD5 vs SHA-1 vs SHA-256: what's the difference?
All three are cryptographic hash functions: they turn input of any length into a fixed-length fingerprint, and the same input always gives the same hash. They differ in output size and in how well they resist attack.
| MD5 | SHA-1 | SHA-256 | |
|---|---|---|---|
| Output size | 128 bits | 160 bits | 256 bits |
| Hex length | 32 characters | 40 characters | 64 characters |
| Collisions | Practical since 2004 | Demonstrated in 2017 (SHAttered) | None known |
| Use today for | Non-security checksums, cache keys | Legacy systems only | Integrity checks, signatures, general use |
A collision means two different inputs with the same hash. Once collisions can be made on purpose, an attacker can swap a file for a tampered one that still matches the published fingerprint. That's why MD5 should only catch accidental corruption, and why NIST has told agencies to phase SHA-1 out completely by December 31, 2030. For anything security-related, use SHA-256.
For reference, the text hello hashes to 5d41402abc4b2a76b9719d911017c592 in MD5 and 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 in SHA-256.
Can SHA-256 or MD5 be decrypted?
No. Hashing isn't encryption. A hash keeps no copy of the input and there's no key, so there's nothing to decrypt. Many different inputs map to each hash value, and finding one from the hash alone is designed to be infeasible.
What attackers do instead is guess. They hash millions of likely inputs, such as common passwords, and look for a match, or look the hash up in a precomputed table. That's why "MD5 decrypt" sites can return hello for its hash: they've seen that input before. A long, random input can't be recovered this way. If you need to get the original text back later, you need encryption with a password instead; try the text encryption tool.
Don't use MD5, SHA-1 or plain SHA-256 for passwords
MD5, SHA-1 and SHA-256 are built to be fast, which is exactly wrong for password storage: a graphics card can test billions of guesses per second. The OWASP Password Storage Cheat Sheet says fast hashes, SHA-256 included, aren't suitable for passwords. Store passwords with a slow, salted algorithm made for the job: Argon2id first, or scrypt, bcrypt, or PBKDF2-HMAC-SHA256 with at least 600,000 iterations.
Use this page for checksums, comparing values, generating cache keys, or testing that your own code produces the expected hash. To create the passwords themselves, use the strong password generator.
Why doesn't my hash match?
One invisible character changes the whole hash. The usual causes:
- A trailing newline.
echo "hello" | sha256sumhasheshelloplus a line break. Useprintf "hello" | sha256sumorecho -nto match this page. - Spaces at the start or end. Tick Trim input before hashing if the other system trims.
- Letter case. Hex output is case-insensitive in meaning, and the compare checker ignores case, but some systems compare strings exactly.
- Encoding. Text is hashed as UTF-8, the default almost everywhere. A system using UTF-16 or Latin-1 gives different hashes for non-ASCII text.
Files are hashed exactly as stored: the tool reads the raw bytes, so Windows line endings (CRLF), a UTF-8 byte order mark and binary data such as ZIPs, images or installers are all included, and the result matches sha256sum file on Linux, shasum -a 256 file on macOS or Get-FileHash file in Windows PowerShell. Trim input only applies to typed text, not to files. Files up to 512 MB can be hashed, and nothing is uploaded.
Frequently asked questions
Is this MD5 hash generator free and private?
Yes. It's free, and all hashing runs in your browser. MD5 is computed with JavaScript on the page and SHA-1 and SHA-256 with the browser's Web Crypto API, so your text is never sent anywhere.
What is a SHA-256 hash?
SHA-256 is a hash function from the SHA-2 family that turns any input into a 256-bit value, usually written as 64 hexadecimal characters. It's widely used for file integrity checks, digital signatures and blockchains.
SHA1 vs SHA256: which should I use?
Use SHA-256. Researchers produced a real SHA-1 collision in 2017, and NIST plans to retire SHA-1 entirely by the end of 2030. Choose SHA-1 only when an older system requires it.
Can SHA256 be decrypted?
No. A hash is a one-way fingerprint with no key, so it can't be decrypted. Short or common inputs can sometimes be guessed by hashing candidates and comparing, which is why hashes alone don't protect passwords.
What is the MD5 hash of an empty string?
It's d41d8cd98f00b204e9800998ecf8427e. Tick Generate hash for empty string to see the empty-input hashes for all three algorithms.
Can I hash a file with this tool?
Yes. Choose or drop any file, up to 512 MB, and its raw bytes are hashed in your browser. The MD5, SHA-1 and SHA-256 values match sha256sum, md5sum, shasum or Get-FileHash for the same file, so you can check a download against its published checksum.
Does it support SHA-512 or bcrypt?
No. The generator creates MD5, SHA-1 and SHA-256 hashes only.