Hash Generator

How it works

1. Type or paste your text. All five hashes update as you type — there is no button to press.
2. Your text is encoded as UTF-8 before hashing, so Thai, emoji and accented characters produce the same digest here as they would anywhere else.
3. Use the copy button beside any digest to put it on your clipboard.
4. Hashing is deterministic: the same input always gives the same output, and a single changed character changes the entire digest.

Which algorithm should you use?

It depends entirely on whether someone might be trying to fool you. Hashes fall into two groups, and mixing them up is the mistake worth avoiding.

• SHA-256 is the sensible default. It is what modern software, certificates and blockchains use, and there is no practical attack against it.
• SHA-384 and SHA-512 are equally sound and produce longer digests. On 64-bit machines SHA-512 is often the faster of the two.
• MD5 and SHA-1 are cryptographically broken. Researchers can construct two different files with the same digest, and have demonstrated it against real PDFs and TLS certificates.
• Broken does not mean useless. MD5 and SHA-1 remain fine for detecting accidental corruption — verifying a download completed, keying a cache, spotting duplicate files — because those situations have no attacker in them.

Do not hash passwords with these

This is the most common misuse, so it is worth stating plainly. These algorithms are designed to be fast, which is exactly wrong for passwords: a modern GPU can try billions of candidates per second against an MD5 or SHA-256 hash. Password storage needs a deliberately slow, salted key derivation function — bcrypt, scrypt or Argon2. Adding your own salt to SHA-256 does not fix this; the speed is the problem, not the salt.

Nothing you paste leaves your device

Hashes are computed in your browser. SHA-1 through SHA-512 use the Web Crypto API built into the browser itself, and MD5 runs as JavaScript on the page. There is no server to send your text to, which matters for a tool people paste API keys, tokens and private notes into. Load the page, disconnect from the internet, and it keeps working.

Common questions

Can I decrypt a hash back to the original text?

No. Hashing is one-way by design — the digest is a fixed-size fingerprint, and the original text is not stored inside it. Sites advertising an "MD5 decrypter" are looking your hash up in a precomputed table of common inputs. They will find "password123" and they will not find anything you actually chose carefully.

Why do MD5 and SHA-1 show a warning?

Both have practical collision attacks: an attacker can craft two different inputs that produce the same digest. This was demonstrated against real TLS certificates for MD5 and against real PDF files for SHA-1. If you are using a hash to prove something has not been tampered with, use SHA-256 or better. For checking a download was not corrupted in transit, MD5 is still perfectly adequate.

Why did my hash change when the text looks the same?

Almost always a trailing space, a newline at the end, or different line endings between Windows and Unix. Hashing is exact — one invisible byte changes the entire digest. Comparing the character counts of the two inputs usually finds it.

Is the hash of Thai text different from the English translation?

Yes, completely. The hash is computed over the UTF-8 bytes, so different characters mean a different digest with no resemblance to the original. Thai characters take three bytes each where plain English takes one, but that affects only the input length, never the output size — every SHA-256 digest is 64 hex characters regardless.

Can I use this to verify a downloaded file?

This tool hashes text rather than files, so it will not help directly with a large download. For text-based checks — comparing a configuration snippet, a certificate fingerprint or a short manifest — paste the content in and compare the digest against the one you were given.

Is this suitable for anything security-critical?

The digests themselves are correct and standards-compliant. But if you are handling secrets, remember that the browser and any extensions you have installed can see what you paste into a page. For genuinely sensitive material, use a local command-line tool such as shasum or certutil instead.