How to use Hash Generator (All)
- Paste the text you want to fingerprint.
- All digests compute at once as you type.
- Copy the one you need, or match an unknown checksum by its length.
- Input is encoded as UTF-8 before hashing, which is what other tools and libraries default to.
- SHA algorithms use the browser’s Web Crypto implementation; MD5 is computed in JavaScript since Web Crypto deliberately omits it.
- Nothing is uploaded — the text stays in the page.
Identifying a hash by its length
Hex digests have a fixed width per algorithm, which is the quickest way to identify an unlabelled checksum. 32 characters is MD5. 40 is SHA-1. 56 is SHA-224, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. If it is 60 characters and starts with $2a$ or $2b$ it is bcrypt, which is a password hash with its cost and salt embedded and cannot be reproduced here. Anything ending in = is probably Base64 rather than hex, so decode it first.
Which of these you should actually use
SHA-256 for anything new. SHA-512 where you want a larger margin, and it is often faster on 64-bit hardware. SHA-1 only to verify something legacy — it has practical collisions and browsers and certificate authorities dropped it years ago. MD5 only for non-adversarial checksums: cache keys, deduplication, spotting accidental corruption. For passwords, none of these: they are all far too fast, and you want Argon2id, scrypt or bcrypt.
Comparing two digests properly
Compare the whole string, case-insensitively — hex is conventionally lowercase but some tools print uppercase, and both are the same value. A digest matching on the first eight characters proves nothing. Also check you are hashing the same thing: a published checksum covers a file’s raw bytes, while this tool hashes the text you paste, and a trailing newline is enough to change every digit of the result.
Frequently asked questions
What is a cryptographic hash?
Which hash should I use?
Are these hashes reversible?
How can I tell which algorithm produced a hash?
Which hash should I use for passwords?
Why does my hash not match the one on the download page?
How do we know nothing is uploaded? Test it yourself on the privacy proof page.