What Hash Generator does
This tool hashes the text you type with three algorithms at once and shows each result as hexadecimal: MD5 (32 characters), SHA-1 (40 characters) and SHA-256 (64 characters). The default input, hello world, gives the MD5 hash 5eb63bbbe01eeed093cb22bb8f5acdc3. Text is encoded as UTF-8 before hashing, the same bytes md5sum and sha256sum receive on a UTF-8 terminal and the usual default when a programming language hashes a string, so the results match theirs when the input is byte-for-byte the same. It hashes typed or pasted text only, not files, and it offers no SHA-512, HMAC or salt. Use SHA-256 for anything where security matters; MD5 and SHA-1 are for checksums and compatibility with older systems.
MD5, SHA-1 and SHA-256 hashes of common test strings
Use these to confirm that another tool or your own code is hashing the same bytes. Inputs are exactly as shown, with no trailing line break.
| Input | MD5 | SHA-1 | SHA-256 |
|---|---|---|---|
| a | 0cc175b9c0f1b6a831c399e269772661 | 86f7e437faa5a7fce15d1ddcb9eaeaea377667b8 | ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb |
| abc | 900150983cd24fb0d6963f7d28e17f72 | a9993e364706816aba3e25717850c26c9cd0d89d | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
| hello | 5d41402abc4b2a76b9719d911017c592 | aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
| hello world | 5eb63bbbe01eeed093cb22bb8f5acdc3 | 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed | b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 |
| Hello World | b10a8db164e0754105b7a99be72e3fe5 | 0a4d55a8d778e5022fab701977c5d840bbc486d0 | a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e |
| test | 098f6bcd4621d373cade4e832627b4f6 | a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 | 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 |
| password | 5f4dcc3b5aa765d61d8327deb882cf99 | 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 | 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 |
| 123456 | e10adc3949ba59abbe56e057f20f883e | 7c4a8d09ca3762af61e59520943dc26494f8941b | 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 |
| admin | 21232f297a57a5a743894a0e4a801fc3 | d033e22ae348aeb5660fc2140aec35850c4da997 | 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 |
| The quick brown fox jumps over the lazy dog | 9e107d9d372bb6826bd81d3542a419d6 | 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12 | d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592 |
password, 123456 and admin are among the first guesses any password-cracking tool tries, so their hashes are recognised on sight. That is why an unsalted fast hash does not protect a password.
MD5 vs SHA-1 vs SHA-256 compared
| Algorithm | Output size | Hex length | Published | Collision resistance | Reasonable uses today |
|---|---|---|---|---|---|
| MD5 | 128 bits | 32 characters | 1992 | Broken; collisions can be made in seconds | Checksums against accidental corruption, cache keys, matching legacy systems |
| SHA-1 | 160 bits | 40 characters | 1995 | Broken; a real collision was published in 2017 | Compatibility with older tools and protocols that still expect it |
| SHA-256 | 256 bits | 64 characters | 2001 | No practical attack known | File integrity, digital signatures, HMAC, content addressing |
None of the three is suitable on its own for storing passwords. See the section on passwords below.
One character changes the whole hash
A good hash function gives unrelated outputs for nearly identical inputs. MD5 values shown; SHA-1 and SHA-256 behave the same way.
Baseline
hello world
MD5 5eb63bbbe01eeed093cb22bb8f5acdc3
A trailing space added
hello world followed by one space
MD5 60c08e2b03b716a176aeb9c2a2fddb79
A trailing line break added
hello world followed by Enter
MD5 6f5902ac237024bdd0c176cb93063dc4, SHA-256 a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447
This is the value echo hello world | md5sum prints, because echo adds a line break.
A full stop added to a sentence
The quick brown fox jumps over the lazy dog.
MD5 e4d909c290d0fb1ca068ffaddf22cbd0, against 9e107d9d372bb6826bd81d3542a419d6 without the full stop
Uppercase output ticked
hello world
MD5 5EB63BBBE01EEED093CB22BB8F5ACDC3
Same hash, different letter case. Hex digits a to f mean the same in either case.
A non-ASCII character
café
MD5 07117fe4a1ebd544965dc19573183da2
The é is hashed as its two UTF-8 bytes. A system using a different text encoding will produce a different hash for the same word.
Getting the same hash on the command line
If a terminal gives a different value from this page, the cause is almost always an extra line break. Use printf, or echo -n, so that only the text itself is hashed.
| System | MD5 | SHA-1 | SHA-256 |
|---|---|---|---|
| Linux | printf '%s' 'hello world' | md5sum | printf '%s' 'hello world' | sha1sum | printf '%s' 'hello world' | sha256sum |
| macOS | printf '%s' 'hello world' | md5 | printf '%s' 'hello world' | shasum -a 1 | printf '%s' 'hello world' | shasum -a 256 |
| Any system with OpenSSL | printf '%s' 'hello world' | openssl md5 | printf '%s' 'hello world' | openssl sha1 | printf '%s' 'hello world' | openssl sha256 |
Each command should print the hello world values from the first table.
Why none of these should be used to store passwords
MD5, SHA-1 and SHA-256 are designed to be fast. That is what you want for checking a download and the opposite of what you want for passwords. An attacker who obtains a database of password hashes can try guesses at enormous speed on ordinary graphics hardware, and because the same password always produces the same hash, every account sharing a password is revealed at once.
Password storage needs a function that is deliberately slow, uses a random salt for each user, and has a cost setting that can be raised over time. Argon2id is the current first choice in OWASP guidance; bcrypt and scrypt are also accepted, and PBKDF2 is used where a certified algorithm is required. This page does none of that. It is for checksums, comparing values and learning how the algorithms behave.
Broken has a specific meaning here. For MD5 and SHA-1 it is collision resistance that has failed: an attacker can craft two different inputs with one hash. Neither has a practical attack that recovers an unknown input from its hash or finds a second input matching a given one, which is why an MD5 checksum still detects accidental corruption but cannot prove a file was not tampered with deliberately.
What this hash generator does not do
- Hash files. Only typed or pasted text is accepted, so it cannot produce the checksum of a download. Use the command-line tools above with a file name for that.
- Hash empty input. The box must contain at least one character that is not whitespace; text made only of spaces or line breaks is not hashed.
- Other algorithms. SHA-512, SHA-3, BLAKE2 and CRC32 are not included.
- Keyed or salted hashing. There is no HMAC option and no salt field.
- Other output formats. Results are hexadecimal only, in lowercase or uppercase; Base64 output is not available.
- Look up or crack hashes. It computes a hash from text and has no way to go from a hash back to text.
How to get your result
- 1
Type or paste into Text to hash. Every character counts, including a trailing space or line break.
- 2
Read the three results labelled MD5, SHA-1 and SHA-256. They recalculate whenever the text changes.
- 3
Tick Uppercase output if the value you are comparing against is written in capital letters.
- 4
Copy the digest you need with the button beside it, and read the Security note before using MD5 or SHA-1 for more than a checksum.