Runs in your browser
Output
What is a hash function?
A hash function takes any input - a word, a file, a whole database - and turns it into a fixed-length string of characters called a digest. Three properties make it useful:
- Deterministic - the same input always produces the same output.
- One-way - you can't recover the original input from the digest.
- Collision-resistant - two different inputs almost never produce the same digest.
Hashing is not encryption - encrypted data can be decrypted back with a key, a hash cannot. And it's not how passwords should be stored on their own: a raw MD5 or SHA-256 digest is fast to brute-force, which is why real systems use a slow, purpose-built algorithm like bcrypt or Argon2 instead.
How it works
- 1Paste your inputDrop in text, JSON, or a license key - anything you want to fingerprint.
- 2Pick an algorithmChoose MD5, SHA-1, SHA-256, SHA-384 or SHA-512 depending on what you need.
- 3Read the outputThe hash updates live as you type, right in your browser.
- 4Compare if neededPaste a known checksum to confirm the two match, character for character.
Algorithm reference
| Algorithm | Bits | Hex chars | Status |
|---|---|---|---|
| MD5 | 128 | 32 | Broken for security - fine for checksums and deduplication only |
| SHA-1 | 160 | 40 | Deprecated for security use, still seen in legacy systems |
| SHA-256 | 256 | 64 | The safe default for most use cases |
| SHA-384 | 384 | 96 | Common in TLS certificate chains |
| SHA-512 | 512 | 128 | Often faster than SHA-256 on 64-bit hardware |
The avalanche effect
A single changed character produces a completely different SHA-256 hash - there is no partial similarity between the two outputs below.
"Hello, World!"-
"Hello, world!"-
Where this comes up
Verifying a downloadPublishers often list a SHA-256 checksum next to a download link. Hash the file you downloaded and paste the published checksum into the compare field above - if they match, the file wasn't corrupted or tampered with in transit.
Deduplicating without security in mindServices like Gravatar turn an email address into an MD5 hash to look up an avatar. Nobody needs to reverse it - it's just a fast, consistent way to turn one value into a fixed-length key.
Common mistakes
- -Storing passwords as a plain SHA-256 or MD5 digest - use bcrypt or Argon2 instead, they're designed to be slow.
- -Using MD5 or SHA-1 anywhere security matters - both are broken against deliberate collision attacks.
- -Comparing hashes by eye - a single mismatched character is easy to miss; use the compare field instead.