Hash Generator Calculator
Generate MD5, SHA-1 and SHA-256 hashes of any text, computed with pure standard algorithms and shown as lowercase hex.
How it works
MD5 (RFC 1321, 128-bit), SHA-1 (FIPS 180-4, 160-bit) and SHA-256 (FIPS 180-4, 256-bit) block hash functions over the UTF-8 bytes of the input, output as lowercase hex
A cryptographic hash squeezes any input, of any length, into a fixed-size fingerprint: 128 bits for MD5, 160 for SHA-1, 256 for SHA-256. It is deterministic and one-way — the same text always hashes to the same value, but you cannot run it backwards to recover the text, and flipping a single bit of input scrambles the whole output (the avalanche effect). Hashes are used for integrity checks, deduplication and, with salting, password storage. Note the security gap: MD5 and SHA-1 are broken for collision resistance and must not be trusted for security, while SHA-256 remains sound — the older two survive only for checksums and legacy compatibility.
Worked example
Hashing "abc" gives MD5 = 900150983cd24fb0d6963f7d28e17f72 (32 hex characters = 128 bits), SHA-1 = a9993e364706816aba3e25717850c26c9cd0d89d (160 bits) and SHA-256 = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad (256 bits). Change "abc" to "abd" and all three change entirely.
Sources: FIPS 180-4 — Secure Hash Standard
Frequently asked questions
Is my text sent to a server?
No — the hashing runs entirely in your browser using built-in algorithms. Nothing you type is transmitted, logged or stored, so it is safe to hash strings you are only testing.
Why should I not use MD5 or SHA-1 for security?
Both are broken against collision attacks — researchers can craft two different inputs with the same hash — so they cannot guarantee integrity against a determined attacker. They are fine for non-adversarial checksums and legacy systems, but new security work should use SHA-256 or stronger.
Can I get the original text back from a hash?
Not by reversing it — hashing is one-way and throws information away. Short or common inputs can sometimes be found by brute force or precomputed "rainbow" tables, which is exactly why passwords must be salted and stretched with a slow function like bcrypt before hashing, not hashed raw.
Related calculators
This calculator is for educational purposes. Double-check important results before acting on them.