Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes locally
Paste text and get every common digest at once, in both hex and base64. The hashing happens in your browser using the Web Crypto API (0 uploads, works offline), so API keys, tokens and passwords you are checking never travel to a server — which is exactly why hashing them on someone else's site is a bad idea.
How to use it
- Paste the text you want to hash, or press Try an example.
- Every algorithm is computed at once — MD5, SHA-1, SHA-256, SHA-384 and SHA-512.
- Each panel shows the hex digest and the base64 form of the same bytes.
- Tick Inspect one item per line to hash a list of strings in one go.
- Copy any digest, or Download the full set to compare against a published checksum.
FAQ
How do I generate a SHA-256 hash online for free?
Paste your text on this page — the SHA-256 digest appears immediately alongside MD5, SHA-1, SHA-384 and SHA-512. It is computed by your browser's built-in Web Crypto implementation, so nothing is uploaded and there is no sign-up, and the output matches any standards-compliant tool byte for byte.
Is MD5 still safe to use?
Not for anything security-related. Collisions in MD5 and SHA-1 are practical, so neither should be used for signatures, certificates or password storage. They remain useful for one thing: checking a file or string against a digest that some existing system already published. The page marks both as broken rather than quietly offering them as equals.
Should I hash passwords with this?
No. Password storage needs a slow, salted algorithm designed for the job — bcrypt, scrypt or Argon2 — because a plain SHA-256 of a password can be brute-forced at billions of guesses per second. This tool is for checksums and digests, not credential storage.
Do these hashes match the ones from sha256sum or Python's hashlib?
Yes. Text is encoded as UTF-8 and hashed as bytes, which is what command-line tools and standard libraries do, so sha256sum and hashlib.sha256() produce identical output for identical input. This page's tests are checked against the published RFC 1321 vectors and against hashlib directly.
Is my input uploaded?
No. Everything is computed on your device and nothing is transmitted or logged — which matters here more than on most tools, since the text people hash is frequently a secret. Turn off your Wi-Fi and the page still works.
Limits
Handles text input; hashing whole files is a separate tool. Digests are computed over the UTF-8 bytes of what you paste, so trailing whitespace and line endings change the result — a common surprise when a digest does not match. MD5 and SHA-1 are provided for compatibility only.
Related
The JWT decoder inspects signed tokens without verifying them, and base64 encode/decode handles the other half of most digest workflows.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.