Hash Generator - MD5, SHA-1, SHA-256, SHA-512 Online Tool

MD5 - 128-bit (32 hex chars)

Developed by Ronald Rivest in 1991, MD5 was the dominant hash algorithm for most of the 1990s and 2000s. It produces a 128-bit (32 hexadecimal character) output. MD5 is cryptographically broken - collision attacks have been demonstrated, meaning two different inputs can produce the same MD5 hash. It should not be used for security-sensitive applications like password hashing or digital signatures. MD5 remains useful for non-cryptographic purposes like file checksums, deduplication keys, and cache invalidation where collision resistance is not critical.

SHA-1 - 160-bit (40 hex chars)

SHA-1 (Secure Hash Algorithm 1) was designed by the NSA and published by NIST in 1995. It produces a 160-bit (40 hex character) digest. SHA-1 was officially broken in 2017 when Google's SHAttered attack demonstrated a practical collision. SHA-1 should not be used for any security purpose. Major browsers and certificate authorities have deprecated SHA-1 for TLS certificates. It persists in legacy systems, Git object storage, and some older protocols, but should be migrated to SHA-256 or stronger.

SHA-256 - 256-bit (64 hex chars) ✓ Recommended

SHA-256 is part of the SHA-2 family designed by the NSA and published by NIST in 2001. It produces a 256-bit (64 hex character) digest and is currently considered cryptographically secure with no known practical attacks. SHA-256 is the most widely deployed cryptographic hash function today, used in TLS/HTTPS certificates, Bitcoin mining (double SHA-256), JWT HMAC-SHA256 signing, code signing, Subresource Integrity (SRI) in browsers, npm package-lock.json integrity fields, and AWS Signature Version 4. For any new development, SHA-256 is the recommended default.

SHA-512 - 512-bit (128 hex chars)

SHA-512 is the strongest member of the SHA-2 family. It produces a 512-bit (128 hex character) digest. While SHA-256 is sufficient for the vast majority of use cases, SHA-512 provides a higher security margin for applications requiring maximum cryptographic strength. SHA-512 is actually faster than SHA-256 on 64-bit processors because it uses 64-bit word operations. It is used in applications requiring long-term security guarantees, high-security digital signatures, and HMAC-SHA512 for API authentication.

SHA-384 - 384-bit (96 hex chars)

SHA-384 is a truncated version of SHA-512, producing a 384-bit (96 hex character) output. It provides a middle ground between SHA-256 and SHA-512 in terms of output size and security margin. SHA-384 is used in some TLS cipher suites and certificate types requiring larger digest sizes without the full overhead of SHA-512. It is part of FIPS 180-4 and is approved for use in U.S. federal government cryptography applications.

CRC32 - 32-bit checksum (8 hex chars)

CRC32 (Cyclic Redundancy Check) is not a cryptographic hash - it is a checksum algorithm designed for error detection in digital networks and storage. It produces a 32-bit (8 hex character) output and is extremely fast. CRC32 is used in ZIP file compression, PNG image format, Ethernet and other network protocols, and zlib compression. It is not suitable for any security purpose because collisions can be engineered intentionally. Use CRC32 only for accidental error detection.

Adler32 - 32-bit checksum

Adler32 is a checksum algorithm developed by Mark Adler as part of the zlib compression library. It is faster but slightly less reliable than CRC32 for detecting errors. Adler32 is used in the zlib format (gzip, deflate compression) and the PNG image standard. Like CRC32, it is not cryptographically secure and should only be used for non-security checksum purposes.

FNV-1a - 32-bit non-cryptographic hash

FNV-1a (Fowler–Noll–Vo) is a popular non-cryptographic hash function known for its speed and good distribution properties. It is widely used in hash tables, databases, programming language runtimes, and data structures where speed matters more than collision resistance. FNV-1a is not suitable for security applications. Our implementation uses the 32-bit variant.

File Integrity Verification

Software downloads are accompanied by SHA-256 checksums so users can verify the downloaded file has not been tampered with or corrupted. Compute the SHA-256 hash of your downloaded file and compare it to the official checksum. If they match, the file is authentic. This is how package managers (npm, pip, apt) verify package integrity.

API Webhook Signatures (HMAC)

Services like GitHub, Stripe, and Shopify sign webhook payloads using HMAC-SHA256 (Hash-based Message Authentication Code). The server computes the HMAC of the request body using a shared secret and sends it in a header. Your server recomputes the HMAC and compares - matching means the payload is authentic and unmodified.

Subresource Integrity (SRI)

When loading scripts or stylesheets from a CDN, add an integrity attribute containing the SHA-256 or SHA-384 hash of the file: integrity="sha256-abc...". Browsers verify the resource matches before executing it, preventing CDN compromise attacks. Generate SRI hashes using this tool.

Content Deduplication

Hash file contents to generate unique fingerprints. Two files with identical SHA-256 hashes are byte-for-byte identical (with extremely high probability). This is how Git identifies commits and blobs, how cloud storage systems detect duplicate uploads, and how CDNs generate cache keys.

Data Fingerprinting and ETags

HTTP ETags use hashes of resource content to enable conditional requests. When content changes, the hash changes, and the browser knows to fetch a fresh copy. Hash-based ETags are also used for cache invalidation in CDNs, API versioning, and optimistic concurrency control in databases.

Password Hashing (Properly)

Plain SHA-256 is not suitable for password storage because it is too fast - attackers can compute billions of SHA-256 hashes per second to crack passwords via rainbow tables or brute force. For passwords, use slow adaptive hash functions: Argon2id (modern best practice), bcrypt, or scrypt, all of which include a random salt and adjustable work factor to resist attacks.

JavaScript (Browser - Web Crypto API)

async function sha256(text) {
  const encoder = new TextEncoder();
  const data = encoder.encode(text);
  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
  return Array.from(new Uint8Array(hashBuffer))
    .map(b => b.toString(16).padStart(2, "0"))
    .join("");
}

const hash = await sha256("Hello, World!");
// a591a6d40bf420404a011733cfb7b190...

Python - hashlib

import hashlib

# SHA-256
sha256_hash = hashlib.sha256(
  "Hello, World!".encode("utf-8")
).hexdigest()

# MD5 (not for security)
md5_hash = hashlib.md5(
  "Hello, World!".encode("utf-8")
).hexdigest()

Node.js - crypto module

const crypto = require("crypto");

const sha256 = crypto
  .createHash("sha256")
  .update("Hello, World!", "utf8")
  .digest("hex");

const md5 = crypto
  .createHash("md5")
  .update("Hello, World!", "utf8")
  .digest("hex");

PHP

// SHA-256
$sha256 = hash("sha256", "Hello, World!");

// MD5
$md5 = md5("Hello, World!");

// SHA-512
$sha512 = hash("sha512", "Hello, World!");