Free Hash Generator: MD5, SHA-1, SHA-256 and more
This free hash generator computes the MD5, SHA-1, SHA-256, SHA-512 and CRC32 hash of any text at once, in lower or upper case hex or base64. Add a secret key to get HMAC values, or paste a hash you were given to verify that it matches your text. It suits developers checking checksums, API signatures and database values, and anyone who needs a quick MD5 or SHA-256.
Hash Generator
Generators and Converters
About this tool
A hash is a fixed-length fingerprint of some input: the same text always gives the same hash, a one-character change gives a completely different one, and the hash cannot be turned back into the text. MD5 (128 bits) and SHA-1 (160 bits) are fast and still common for checksums and cache keys, but both are broken for security use because collisions can be manufactured. SHA-256 and SHA-512 are the current standard for signatures, integrity checks and password-related work. CRC32 is not a cryptographic hash at all, just a quick error-detection code used by ZIP files and network protocols.
The text is hashed exactly as you paste it, as UTF-8 bytes, with Windows line endings normalised to LF. A trailing newline changes the result, which is the usual reason a hash does not match the one from a command line tool. With a key, the HMAC option computes the keyed hash that APIs use to sign requests, which is what you want when a provider says "sign the payload with your secret using HMAC-SHA256". CRC32 is skipped when a key is set, because it is not a cryptographic hash and cannot be keyed. Your text and key are processed in memory and never stored.
What this tool is not for: hashing a file (open it and paste the content for small text files only), and storing passwords. Never store a plain MD5 or SHA hash of a password; use a slow, salted algorithm such as bcrypt or Argon2 through your framework's password library instead.
Frequently asked questions
Is MD5 still safe to use?
For checksums, cache keys, deduplication and ETags, yes: it is fast and the chance of an accidental collision is negligible. For anything an attacker could tamper with, such as signatures, certificates or password storage, no. Collisions can be created on purpose, so use SHA-256 or better for security, and a dedicated password hasher for passwords.
Why does my hash not match the one from the terminal?
Almost always a trailing newline: echo adds one unless you use echo -n, and many editors add one at the end of a file. Other causes are Windows line endings, a byte order mark, a different character encoding, or upper-case hex compared with lower-case. Hash the exact bytes, compare in the same case, and the two will agree.
Can I reverse a hash to get the original text?
No. Hashing is one-way by design, and the output carries far less information than most inputs. The "MD5 decrypt" sites simply look the hash up in a table of hashes of common words and passwords, which is exactly why plain hashes of passwords are dangerous. If you need to get data back, you want encryption, not a hash.
What is HMAC and when do I need it?
HMAC combines a hash function with a secret key, so only someone who knows the key can produce or check the value. APIs such as payment gateways and webhooks use HMAC-SHA256 to sign payloads: you hash the request body with your secret and send the result, and the provider recomputes it to confirm the request is genuine and unchanged.
Which hash should I use for a file checksum?
SHA-256 is the usual choice today: it is what most download pages publish and what package managers verify. MD5 and SHA-1 are fine for detecting accidental corruption but should not be the only check for software downloads. This tool hashes pasted text only; for files use your operating system's built-in checksum command.