Hash generator. MD5 to SHA-512.

What a hash is, and what it is not

A hash function turns any input into a fixed-length string. The same input always gives the same output, and there is no way back — you cannot decrypt a hash, because nothing was encrypted. That one-way property is the whole point.

SHA-256("hello")  →  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("hellp")  →  8b8d7a1a4a4b48d2a0f4b5e17d6d0e1f9c2a1e6c7c1a1c6f5b4a3d2e1f0a9b8c

Which one to use

• MD5 — broken. Collisions can be produced on a laptop. Fine as a checksum against accidental corruption, never for anything security-related.
• SHA-1 — broken. A practical collision was demonstrated in 2017 and it has been deprecated everywhere since.
• SHA-256 — the sensible default. Fast, well analysed, widely supported.
• SHA-512 — the same family with a longer output. On 64-bit hardware it is often faster than SHA-256, not slower.

Do not hash passwords with any of these

This is the mistake worth the most words. SHA-256 is fast, and fast is exactly wrong for passwords. A consumer GPU computes billions of SHA-256 hashes a second, so a stolen table of SHA-256 password hashes is a list of passwords by the weekend.

Password hashing needs a function designed to be slow and memory-hungry:

• Argon2id — the current recommendation. Tunable in time, memory and parallelism.
• bcrypt — older, still solid, available everywhere.
• scrypt — also memory-hard, a reasonable choice.

All three salt automatically, which stops one precomputed table from cracking every account at once. If your code calls sha256(password) anywhere, that is the finding to fix first.

And do not compare hashes with ==

A normal string comparison returns as soon as two characters differ, so how long it takes leaks how much of the value was right. Over enough requests that is enough to reconstruct a token. Use the constant-time comparison your language provides — hmac.compare_digest in Python, crypto.timingSafeEqual in Node.

What hashes are genuinely good for

• Integrity. Publish a SHA-256 of a download so anyone can check the file arrived intact.
• Deduplication. Same hash, same content, no need to store it twice.
• Content addressing. Git names every object by its hash, which is why a commit id identifies exactly one tree.
• Signatures and HMACs. Not the hash alone, but a hash inside a construction that also involves a key.

This runs in your browser

The tool above uses the Web Crypto API in your own browser. Nothing you type is sent anywhere, which matters if you are hashing something you would not paste into a form on a site you do not control — and you should assume most online hash tools do exactly that.

Finding weak hashing in a codebase

Spartyx flags MD5 and SHA-1 used where a secure hash is needed, fast hashes applied to passwords, and non-constant-time comparisons — across every file, rather than the one you remembered to check.

Scan a public repository free, no account needed.