What is a hash generator?
A hash generator computes a cryptographic digest from text you provide — a fixed-length fingerprint that uniquely identifies the input (in practice) without revealing it. Developers use hashes to verify file integrity after download, compare API payloads, debug authentication flows, generate cache keys, and confirm that two strings are identical without storing the original.
This tool supports three widely used algorithms: MD5, SHA-256, and SHA-512. Paste or type any string, pick an algorithm, click Generate, and copy the hexadecimal result. Everything runs in your browser using the Web Crypto API for SHA family hashes, so nothing is transmitted to a server.
How to use the hash generator
- Enter the text you want to hash — a password (for testing only), JSON snippet, URL, or arbitrary string.
- Select an algorithm. SHA-256 is the best default for integrity checks; MD5 is shorter and faster but weaker; SHA-512 produces a longer digest.
- Click Generate. The hex digest appears below within milliseconds for typical inputs.
- Copy the hash and compare it against a reference value from documentation, a CLI tool, or another system.
- Change the algorithm or input to see how the digest length and value change — even a single extra space alters the entire hash.
Examples
SHA-256 of the word hello
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824MD5 of hello
5d41402abc4b2a76b9719d911017c592Notice how MD5 is only 32 hex characters while SHA-256 is 64. SHA-512 would be 128 hex characters — four times longer than MD5.
Verifying API webhook signatures
Many APIs sign request bodies with HMAC-SHA256. While HMAC requires a secret key, developers often hash the raw body first to inspect what enters the signing function. Paste the exact bytes — including newlines — from the JSON Formatter to avoid whitespace mismatches.
How hashing algorithms differ
MD5 (Message Digest 5) was designed in 1991 and outputs 128 bits. Collision attacks are practical today, so MD5 must not be used for digital signatures or certificate verification. It remains common in legacy systems and etag generation.
SHA-256 is part of the SHA-2 family standardized by NIST. It outputs 256 bits and is the hash behind Bitcoin block headers, TLS certificate fingerprints, and most modern integrity checks. No practical preimage or collision attacks are known for SHA-256 in general use.
SHA-512 also belongs to SHA-2 but outputs 512 bits. It processes data in 1024-bit blocks rather than 512-bit blocks, which can improve throughput on 64-bit hardware. Some systems truncate SHA-512 to SHA-384 or SHA-512/256 for specific profiles.
Common use cases
- Download verification — compare a published SHA-256 checksum against a file you downloaded.
- Cache busting — append an MD5 or SHA hash of file content to static asset URLs.
- Debugging auth — confirm the client hashes the same string the server expects before comparing tokens.
- Deduplication — store hashes instead of full text to detect duplicate records cheaply.
- Pairing with encoding — hash then Base64-encode for compact binary-safe transport in headers or cookies.
Security reminders
Hashes are not encryption. Do not rely on MD5 or even SHA-256 alone to protect passwords in a database — use salted slow hashes designed for credentials. When comparing secret values, use constant-time comparison functions in application code to avoid timing leaks. For generating strong secrets rather than fingerprinting them, use the Password Generator instead.