Guide
How to use this tool well
Hashing turns input into a fixed-length fingerprint. This page runs MD5, SHA-1, SHA-256, and SHA-512 locally β useful for checksums, debugging, and learning; not for storing login passwords.
Hashing is not encryption
Encryption can be reversed with a key. A hash is meant to be one-way: the same input always yields the same digest, but you cannot βdecodeβ SHA-256 back to the original sentence.
Websites store password hashes (ideally with bcrypt or Argon2, not bare SHA-256). Developers use SHA-256 to verify file downloads: compare the published digest with the hash of the file you downloaded.
Which algorithm should I use?
MD5 and SHA-1 still appear in legacy systems and quick file integrity checks. Do not use them for new security designs β collision attacks are practical for motivated attackers.
SHA-256 is the everyday choice (Git objects, TLS certificates, blockchain). SHA-512 is stronger on paper but slower; pick it when specs require it, not by default for short strings.
- File tab: reads the file in-browser and hashes bytes β nothing uploaded.
- Text tab: hashes UTF-8 text; emoji and newlines change the digest.
- Same input β same hash; one-bit change β completely different output (avalanche effect).
Common questions
- Can I recover my password from a hash?
- No. Attackers use wordlists and GPUs to guess passwords and compare hashes. That is why sites must use slow password hashes, not plain SHA-256.
- Why do two files with the same size have different hashes?
- Because the content differs. Hash collisions for SHA-256 are theoretically possible but not a practical concern for file integrity checks.
Editorial standards: how we write and review guides.