MD5 is not offered: the Web Crypto API does not provide it, and it has been unsuitable for security use for years. Use SHA-256 unless something legacy forces otherwise.
How it works
What a cryptographic hash is for
A hash maps input of any size onto a fixed-length digest. The useful properties are that the same input always gives the same digest, a different input almost certainly gives a different one, and you cannot work backwards from the digest to the input.
That makes hashes right for integrity — confirming a download was not altered, detecting whether a file changed, deduplicating content. It does not make them right for passwords.
Why MD5 and SHA-1 are no longer security algorithms
Both are broken for collision resistance: it is practical to construct two different inputs with the same digest. MD5 collisions take seconds; SHA-1 was demonstrated in 2017 and has only become cheaper since.
They remain acceptable as non-security checksums — a cache key, a quick change detector — and SHA-1 is offered here because legacy systems still emit it. For anything where an attacker benefits from a collision, use SHA-256.
Never hash a password with these
SHA-256 is designed to be fast, which is exactly wrong for passwords: a modern GPU computes billions of SHA-256 hashes per second, so a plainly hashed password falls quickly to brute force, and identical passwords produce identical digests.
Password storage needs a slow, salted algorithm built for the job: Argon2id first, then scrypt or bcrypt. Each salts automatically and has a tunable cost factor. Use a library rather than assembling this yourself.
What people use it for
- Verifying a download against a published SHA-256 checksum.
- Generating a content hash for a cache key or an ETag.
- Checking whether two texts are identical without comparing them in full.
- Producing a fingerprint for deduplication.
- Reproducing a hash a system expects, to debug a mismatch.
Nothing is uploaded. This tool runs entirely in JavaScript in your browser. Your input is never sent to a server, never logged and never stored, and no account is required. Once the page has loaded you can go offline and it still works — open your browser's network tab and watch if you'd like to confirm it.
Frequently asked questions
Why is MD5 not offered?
The Web Crypto API does not implement it, and it has been unsuitable for security use for years, since MD5 collisions can be generated in seconds. Shipping a separate implementation to compute a broken hash is not worth it. Use SHA-256.
Can I use SHA-256 to store passwords?
No. SHA-256 is fast by design and a modern GPU computes billions of digests per second. Use a slow, salted password hash: Argon2id, scrypt or bcrypt, through a library.
Is SHA-1 safe to use?
Not for security. Practical collision attacks were demonstrated in 2017. It is fine as a non-security checksum and is offered here because legacy systems still produce it.
Can I hash a file?
Not with this tool, which works on text. Use certutil -hashfile yourfile SHA256 on Windows, or sha256sum yourfile on Linux and macOS.
Does hashing happen on a server?
No. It uses your browser's Web Crypto implementation and runs locally, so the text is never transmitted. Note that Web Crypto requires a secure context, meaning https or localhost.
Tools that run where your code is
This page does its work in your browser because sending your data to a server to process it is a bad default. Catalase applies the same idea to AI coding: a free, open-source code editor that runs language models on your own machine through Ollama, with no account and no telemetry. Cloud models are there when you choose one, not by default.
Related tools
- API key generator — Secure random keys generated locally.
- Random string generator — Secure random strings with entropy shown.
- UUID generator — Random version 4 UUIDs.