Hash Generator Online: MD5, SHA-1, SHA-256 & SHA-512

How to generate a hash

1. Type or paste your text into the Text Input box. The character counter below it confirms what was captured, including trailing spaces and newlines.
2. Pick an algorithm from the selector. SHA-256 is the safe default; switch to MD5 or SHA-1 only for legacy checksums.
3. Read the hex digest in the Hash Output panel. It recalculates on every keystroke, and the header shows the exact hash length in characters.
4. Click Copy to put the digest on your clipboard, or the download icon to save it as toolk-hash-{algorithm}.txt.
5. To verify a checksum, compare the output to the publisher's value character by character — a single mismatch means the data changed.

What is a cryptographic hash, and how does it work?

A cryptographic hash function maps an input of any size to a fixed-length output called a digest. Three properties define it: it is deterministic (the same input always yields the same digest), one-way (you cannot run it backward to recover the input), and it shows the avalanche effect (flipping one input bit changes about half the output bits). The SHA-2 family here is standardized by NIST in FIPS 180-4, the Secure Hash Standard.

This tool computes SHA-1, SHA-256, SHA-384, and SHA-512 with the browser-native Web Crypto API crypto.subtle.digest(). Your text is encoded to UTF-8 bytes via TextEncoder, hashed, then formatted as lowercase hex. Note that hashing is not encryption: encryption is reversible with a key, while a hash has no decrypt step. Read more in our developer guides on the Toolk blog.

Worked examples

Paste these exact inputs to reproduce the digests below. The empty-string hashes are well-known constants you can use to confirm any hasher is wired correctly.

Failing edge case — the avalanche effect: adding a single period to make "The quick brown fox jumps over the lazy dog." does not nudge the MD5 digest — it rewrites it completely to e4d909c290d0fb1ca068ffaddf22cbd0. Two near-identical inputs share zero visual similarity in their hashes, which is exactly why partial matching never works.

Privacy: it all runs on your device

Runs 100% in your browser — your data never leaves your device. No uploads. We hashed everything from empty strings and single emoji up to multi-megabyte pasted text; the SHA digests come straight from your browser's audited crypto engine, and nothing is logged. Because there is no server round-trip, you can hash API secrets, tokens, and config values without them ever touching a network.