Type or paste text and see its MD5, SHA-1, SHA-256 and SHA-512 hashes at the same time. If you already have a hash from a download page, an API doc or a colleague, paste it in the compare box and the tool tells you which algorithm it matches, if any.
Developers reach for hashes when they need a short, stable label for a larger piece of data. A file name with a hash in it lets a browser cache an asset forever, because any change to the file produces a new name. A hash of a request body can be compared with the one the sender included, to confirm nothing was altered on the way.
Hashes also catch accidental damage. A download page that lists a SHA-256 value lets you confirm the file arrived intact. If the hash you compute differs by even one character, the file is not the one the publisher released, whether from a bad download or something worse.
MD5 and SHA-1 are old. Researchers have found ways to build two different inputs with the same MD5 or SHA-1 hash, so neither belongs in a security design such as a signature or certificate. They remain common as quick fingerprints because they are short and fast, and plenty of older systems still publish them.
SHA-256 and SHA-512 belong to the SHA-2 family and have no known practical attacks. SHA-256 is the usual default for new work. SHA-512 produces a longer value and is often quicker on 64-bit processors for large inputs, so you will see it in some signing and token schemes.
A good hash function is fast, which is exactly the wrong property for passwords. An attacker who steals a table of plain SHA-256 password hashes can test billions of guesses a second against it, and everyone who chose a common password is exposed at once.
Password schemes add a random salt per user and deliberately take a measurable amount of time per guess. If you are building a login system, use a well-tested library for that job instead of writing your own, and keep this tool for the fingerprinting and checking jobs hashes are suited to.
A hash is a fixed-length fingerprint of some data. The same input always gives the same hash, a tiny change in the input gives a completely different hash, and you cannot work backwards from the hash to the original text.
MD5 is 128 bits, shown as 32 hexadecimal characters. SHA-1 is 160 bits, 40 characters. SHA-256 is 256 bits, 64 characters. SHA-512 is 512 bits, 128 characters. For example, the MD5 of the three letters abc is 900150983cd24fb0d6963f7d28e17f72.
No. The hashes are calculated by code running in your browser, so your text is never sent to a server.
The usual causes are an extra space or line break at the end, a different line ending style, a different text encoding, or the other side using a different algorithm. Try the compare box: it reports which of the four algorithms, if any, produces the hash you pasted.
This version hashes text typed or pasted into the box. To fingerprint a file, use the checksum command built into your operating system, such as shasum on macOS and Linux or Get-FileHash on Windows.
No. A hash is not encryption, so there is nothing to decrypt. Websites that claim to reverse hashes simply look the hash up in a table of common words and passwords they have already hashed.
Related: JSON formatter and validator, Hex converter, Robots.txt generator.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.