Hash Generator (MD5 / SHA family)

What is a cryptographic hash?

A cryptographic hash function takes an arbitrary input and produces a fixed-length output called a digest. The function is deterministic (same input always produces the same digest), efficient to compute, and infeasible to invert — given a digest you cannot practically reconstruct the input. Two inputs producing the same digest is called a collision; a good hash function makes collisions essentially impossible to find.

This tool computes five standard digests at once. SHA-1, SHA-256, SHA-384, and SHA-512 are computed using the browser's Web Crypto API, which delegates to the same vetted implementations the rest of the platform uses. MD5 is computed by a hand-written port of RFC 1321 because Web Crypto deliberately omits MD5 — it is considered cryptographically broken and is offered here only for compatibility with legacy systems such as Apache htpasswd files or old API checksums.

Use cases

• Generate file or content checksums for cache busting and integrity checks.
• Compute the SHA-256 of an email address before sending it to an analytics endpoint that expects hashed PII.
• Verify that a message you received matches the digest published by the sender.
• Produce content-addressed identifiers for documents stored in S3 or IPFS.
• Generate stable cache keys for memoised API responses.

Best practices

• Do not use MD5 or SHA-1 for any security-sensitive purpose — both are broken against collision attacks.
• For password storage use a slow KDF such as bcrypt, scrypt, or Argon2 instead of a raw hash.
• When hashing user input always normalise (trim, lowercase) consistently on both sides.
• Choose SHA-256 as the default for new applications; step up to SHA-512 only if you are constrained by an external spec.

Reference

Frequently asked questions