Hash Generator
SHA-1, SHA-256, SHA-384 and SHA-512, computed with the browser's own SubtleCrypto API.
Which algorithm to use
SHA-256 for anything new. SHA-512 if you want a longer digest and are on 64-bit hardware, where it is often faster. SHA-1 is here for verifying legacy artefacts and nothing else — a practical collision was demonstrated in 2017 and it has been unsuitable for signatures ever since. MD5 is not offered at all: collisions have been trivial to produce for close to two decades, and a tool that quietly emits an unsafe digest is worse than one that declines.
Hashing is one-way, and not a password store
A hash cannot be reversed, but that does not make it safe for passwords. A bare SHA-256 of a password can be brute-forced at enormous speed on commodity hardware and looked up directly in a rainbow table if it is unsalted. Password storage needs a deliberately slow, salted function — bcrypt, scrypt or Argon2 — not a general-purpose digest.
These digests are produced by SubtleCrypto, the browser's native cryptography API, so your input is hashed on your machine and never transmitted.
Common questions
Why is there no MD5 option?
MD5 collisions have been trivially producible for nearly two decades. Offering it invites people to use it for integrity checks where it provides none. Use SHA-256.
Can I use SHA-256 to store passwords?
No. Use bcrypt, scrypt or Argon2. A general-purpose digest is far too fast, which is exactly what an attacker wants.
Is my input sent anywhere?
No. Hashing uses the browser's built-in SubtleCrypto API and runs entirely on your device.