Hash Generator: MD5, SHA-1, SHA-256

How to use it

1. Type or paste the text into Text.
2. Leave Key (optional) empty for plain digests, or type a key to get HMACs.
3. Copy a digest from its row, or use Download as CSV to keep the whole table.
4. Check the algorithm in the first column against the one your system or document asks for.

What a hash is

A hash function turns any text into a code of fixed length, called a digest. The same text always gives the same digest, a small change gives a completely different one, and the digest cannot be turned back into the text. Here the digests are written in hexadecimal: MD5 has 32 digits, SHA-1 has 40, SHA-256 has 64, SHA-384 has 96 and SHA-512 has 128.

Hexadecimal digits = bits ÷ 4

MD5      128 ÷ 4 = 32
SHA-256  256 ÷ 4 = 64
SHA-512  512 ÷ 4 = 128

Which algorithm to use

MD5 and SHA-1 are broken. Two different texts can be found with the same digest, so they must not be used for signatures or certificates. They still appear in old systems and as a quick check against accidental damage to a download. SHA-256 and SHA-512 belong to the current standard, FIPS 180-4, and are the usual choice.

To store passwords, use a password hashing function such as Argon2 or bcrypt. None of the digests on this page is meant for that.

HMAC: a digest with a key

An HMAC (RFC 2104) combines a key with a hash in a fixed way. Only someone who knows the key can make the same HMAC, so it shows that a message comes from a known sender and was not changed on the way. The page computes HMACs with the same algorithms as the plain digests.

Text is bytes

• The text is hashed as UTF-8 bytes (RFC 3629). ASCII letters take one byte, Turkish letters such as ğ take two, and an emoji takes four.
• A different line ending, a different encoding or one extra space gives a different digest, so hash the same bytes as the other tool.

Frequently asked questions