Generate a hash

How to use it#

1. Type or paste the text you want to hash.
2. Every algorithm is computed as you type, so there is nothing to press.
3. Switch between hex and Base64 to reformat the same digests, then copy the one you need.

What a hash can and cannot do for you#

A hash function turns any amount of input into a fixed-length value, and the same input always produces the same output. Change one character and the digest changes completely, which is what makes it useful for checking that a file arrived intact or that a value has not been edited.

It only works in one direction. You cannot recover the text from the digest, because the function throws information away. What you can do is guess: hash a candidate and see whether it matches. For short or common inputs that guessing is cheap, which is why a hash on its own is not a way to store passwords.

Storing passwords needs a function built to be slow and salted per user, such as bcrypt, scrypt or Argon2. A SHA-256 of a password is fast to compute, which means it is also fast for somebody else to compute several billion times against a leaked database.

Which of these are still safe#

MD5 and SHA-1 are both broken in the sense that matters: it is practical to construct two different inputs with the same digest. MD5 collisions can be produced in seconds, and a SHA-1 collision was demonstrated in 2017. Neither should be used where somebody might benefit from forging a match, such as a signature or a security token.

They remain perfectly reasonable as non-adversarial checksums. Verifying that a download was not corrupted in transit, or that a cache key still points at the same content, does not involve an attacker choosing the input. A great deal of existing software emits MD5 for exactly this reason, which is why the tool still offers it.

For anything new, SHA-256 is the sensible default. SHA-384 and SHA-512 produce longer digests and are no slower on 64-bit hardware, but a longer hash is not more secure in any way that will matter to most work.

Hex and Base64 are the same bytes#

A digest is a fixed number of bytes: 16 for MD5, 32 for SHA-256, 64 for SHA-512. Hex writes each byte as two characters, so a SHA-256 becomes 64 characters. Base64 packs three bytes into four characters, which makes the same digest about a third shorter.

Checksums published alongside downloads are almost always hex. Base64 turns up in HTTP headers and in subresource integrity attributes, where length matters more than being able to read it. Switching the setting here reformats the digests already on screen rather than computing them again.