Hash Generator
Output format
Share with friends
How to use
- 1 Paste your text into the input box. Hashes update as you type.
- 2 Choose output format: hex (most common) or Base64 (more compact).
- 3 All six algorithms produce a hash simultaneously — copy the one you need.
- 4 For file integrity verification (checksums), use the same input and compare with the published hash.
- 5 Never use these hashes to store passwords. Use bcrypt, Argon2, or PBKDF2 with proper salt for password hashing.
About Hash Generator
FAQ
Q Should I use MD5 or SHA-256 for passwords?
Neither — both are too fast. Password storage requires deliberately slow hashes designed to resist brute-force attacks: bcrypt (work factor 12+), Argon2id, or PBKDF2 with 600,000+ iterations. NIST SP 800-63B is the US government standard for password hashing.
Q Is MD5 safe for file checksums?
For non-adversarial integrity (detecting accidental corruption during download), yes. For security-critical use (verifying you got the legitimate file vs. a malicious replacement), use SHA-256 or higher — MD5 collisions can be crafted, so an attacker could substitute a malicious file with the same MD5.
Q When did NIST deprecate SHA-1?
NIST formally deprecated SHA-1 for digital signatures in 2011 and disallowed it for federal use after 2013 (SP 800-131A). Browsers stopped trusting SHA-1 SSL certificates in 2017. The full SHA-1 phase-out date in NIST policy is 2030 — applications still using it should migrate to SHA-256 or SHA-3.
Q What is the difference between SHA-2 and SHA-3?
SHA-2 (SHA-256, SHA-512, etc.) was published by NIST in 2001 and is based on the Merkle-Damgard construction. SHA-3 (NIST FIPS 202, 2015) uses a completely different design called Keccak / sponge construction. Both are secure today; SHA-3 was standardized as a backup in case future attacks weaken SHA-2.
Q How long is each hash output?
MD5: 128 bits (32 hex chars). SHA-1: 160 bits (40 hex chars). SHA-256 / SHA3-256: 256 bits (64 hex chars). SHA-512 / SHA3-512: 512 bits (128 hex chars). Base64 output is roughly 4/3 the byte length of the binary digest.
Q Why is HMAC needed when SHA-256 already exists?
A plain hash protects integrity but not authenticity — anyone can compute a hash. HMAC adds a secret key, so only parties who know the key can produce a valid HMAC. APIs use HMAC-SHA-256 to prove a request was signed by someone with the shared secret (AWS Signature V4, Twilio, Stripe webhook signatures).
Q Are these hashes deterministic?
Yes. The same input always produces the same hash, byte for byte. This is what makes hashes useful for content addressing (Git, IPFS, Bitcoin) and integrity verification. Cryptographic randomness (UUIDs, session tokens) requires a different mechanism — never use a hash of a counter as a unique ID.
Q How is data sent to your server when I generate a hash?
It isn't. Hashing runs entirely in your browser via PHP for the initial render, but interactive hashing happens client-side when you type. Sensitive inputs (API keys, secrets) stay on your machine. For maximum confidence, copy the page locally and run it offline.
Official resources
NIST FIPS 180-4 — Secure Hash Standard (SHA-2)
Authoritative NIST specification of SHA-1, SHA-256, SHA-512, and the SHA-2 family.
NIST FIPS 202 — SHA-3 Standard
Authoritative NIST specification of SHA-3 (Keccak-based) hash family.
NIST SP 800-131A — Algorithm Transitions
NIST policy for transitioning away from deprecated algorithms (SHA-1, etc.).
NIST SP 800-63B — Digital Identity Guidelines
US standard for password hashing, including memorized secret verifier requirements.