Hash Generator

Enter any text to compute its hash with every common algorithm at once — MD5, SHA-1, the SHA-2 family, SHA-3 and CRC32. Computing them all together means you can match an existing hash against the list to work out which algorithm produced it, without guessing one at a time.

Each result is labelled with whether the algorithm is still fit for security use, because several of these remain in wide circulation long after they stopped being safe.

How it works

A hash function turns input of any length into a fixed-length fingerprint. The same input always produces the same output, and changing a single character changes the result completely. Crucially, the process only runs one way: you cannot recover the input from the hash.

Which algorithm to use depends entirely on the job:

• MD5 and SHA-1 are broken. Practical collision attacks exist for both — two different inputs can be made to produce the same hash. They are fine for detecting accidental corruption in a file transfer, and unacceptable for signatures, certificates or anything an attacker can influence.
• SHA-256 and above are the current default. Use SHA-256 unless you have a specific reason not to; SHA-512 is often marginally faster on 64-bit hardware.
• SHA-3 uses a completely different internal construction, so it is a useful hedge: a future weakness in SHA-2 would be unlikely to affect it.
• CRC32 is not a hash at all in the security sense. It is a checksum for catching transmission errors, and is trivial to forge.

Never use these to store passwords. All of them are designed to be fast, which is exactly wrong for password storage — speed lets an attacker try billions of guesses per second against a stolen database. Passwords need a deliberately slow, salted algorithm such as bcrypt or Argon2.

Frequently asked questions