Hash Generator

Hash Generator – Create Cryptographic Hashes

A cryptographic hash is like a digital fingerprint. Any input, text, file, or password, produces a fixed-length string that changes completely if even a single character of the input changes. This tool supports MD5, SHA-1, SHA-256, SHA-512, and the CRC32 checksum. You can enter text or choose a file, all running natively in your browser through the Web Crypto API.

Everything runs client-side. Your text is not transmitted to our server. For SHA-1, SHA-256, and SHA-512 it uses the hardware-accelerated crypto.subtle.digest() function, the same technology behind HTTPS. MD5 and CRC32 are implemented in JavaScript so you can still use these common standards. For files, the tool computes one hash per selected file and lists the results with size and name.

The supported algorithms at a glance

Algorithm	Output length	Hex chars	Use
MD5	128 bit	32	older checksums, not recommended for security today
SHA-1	160 bit	40	older signatures, integrity; collisions possible
SHA-256	256 bit	64	recommended for integrity and fingerprints
SHA-512	512 bit	128	longer output, very strong
CRC32	32 bit	8	fast error detection for data, not cryptographic

Worked example with the input Hallo:

• MD5: d1bf93299de1b68e6d382c893bf1215f
• SHA-1: 59d9a6df06b9f610f7db8e036896ed03662d168f
• SHA-256: 753692ec36adb4c794c973945eb2a99c1649703ea6f76bf259abb4fb838e013e
• SHA-512: 2d0e4a42d260c2407281975322837e61c1362a3b18be38b71eb6f4dfd3e4f992d...
• CRC32: 78b31ed5

Change just one character, say Hallo to Hallo!, and the result is completely different. That is a core property of good hash functions.

What are cryptographic hashes used for?

• Password storage hashes are used to store passwords securely (though with salt and slow algorithms like bcrypt, not plain)
• Integrity checks verify a downloaded file has not been altered (same hash means same content)
• Fingerprints SSL certificates and SSH keys are often shown as hash fingerprints
• Checksums make sure data was not corrupted during transfer
• Database indexes hashes help index large data sets quickly

What a hash cannot do

Hashes are one-way functions: you cannot compute the input back from the output. There is no inverse. Also be aware of the following:

• Collisions are possible. For MD5 and SHA-1, deliberately constructed collisions (two different inputs with the same hash) have been known for years, so they are no longer considered collision-resistant.
• Not a password replacement. Storing a plain SHA-256 hash of a password is insufficient because attackers use dictionaries and rainbow tables. The officially recommended approach is slow, salted algorithms such as bcrypt, scrypt or Argon2.
• CRC32 is not cryptography. It is fast error detection but easy to collide deliberately and never intended for security.

SHA-256 vs. MD5

SHA-256 is considered cryptographically secure and is used by governments and companies worldwide. MD5 is still widespread, especially in older systems and for checksums, but it has been broken for years, targeted collisions are possible. For security-critical applications, stick with SHA-256 or SHA-512.

Integrity checking in practice

The most common everyday use of a hash is integrity checking: you download a file, compare the SHA-256 value given on the source page with the locally computed one, and if both match the file is unchanged. That is exactly what this tool is for. Select a file, it computes the hash per file, and you compare it against the official value. If the hashes differ, the file was modified or damaged. This is also the basis for checksums found on many download portals.

Why slow hashing matters for passwords

A classic hash such as SHA-256 is deliberately extremely fast. That is exactly what makes it problematic for password storage: an attacker can test huge numbers of candidates in a short time. That is why serious systems use slow, salt-based schemes for passwords, such as bcrypt, scrypt or Argon2, which cost a lot of compute time per attempt. A high compute cost per candidate protects the password even if the hashes are stolen from a database. For pure integrity checks the fast SHA-256 is perfectly fine.

Frequently asked questions