MD5 Hash Generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of the same input, computed together as you type. Paste a checksum you were given and the tool works out which algorithm produced it and whether it matches — which is the actual job when verifying a download.
Free · No signup · Runs entirely in your browser
One input, every digest at once. This hash generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 in your browser as you type — nothing is uploaded, which matters when the string you are checksumming is not public.
11 bytes of UTF-8
| Algorithm | Digest | Copy |
|---|---|---|
| MD5checksum only | 5eb63bbbe01eeed093cb22bb8f5acdc3 | |
| SHA-1checksum only | computing… | |
| SHA-256 | computing… | |
| SHA-384 | computing… | |
| SHA-512 | computing… |
Check a hash you were given
Paste the checksum published alongside a download and this will tell you which algorithm it is and whether it matches — you do not have to know in advance.
MD5 and SHA-1 are broken: collisions can be produced deliberately, so neither proves a file was not tampered with. They remain fine for detecting accidental corruption. And none of these are password hashes — storing passwords needs bcrypt, scrypt or Argon2, which are deliberately slow.
Checksums are the cheap half of supply-chain hygiene; knowing what your dependencies actually do is the expensive half. Connect GitHub and Tekk turns what you want into specs your coding agent can actually execute against the real repo.
What a hash is
A hash function takes any amount of input and returns a fixed-size digest. Three properties are what make it useful:
- Deterministic. The same bytes always produce the same digest.
- Avalanche. Change one bit of input and roughly half the output bits flip.
- One-way. There is no operation that recovers the input from the digest.
The classic demonstration, using the vectors published in RFC 1321:
| Input | MD5 |
|---|---|
| `` (empty) | d41d8cd98f00b204e9800998ecf8427e |
a |
0cc175b9c0f1b6a831c399e269772661 |
abc |
900150983cd24fb0d6963f7d28e17f72 |
message digest |
f96b697d7cb7938d525a2f31aaf161d0 |
Those four are from the RFC's own test suite, and this page's implementation is checked against all seven of them on every build — so the numbers documented here and the numbers the tool produces cannot drift apart.
Digest lengths
Length alone identifies the algorithm, which is what makes the compare box above possible:
| Algorithm | Bits | Hex characters |
|---|---|---|
| MD5 | 128 | 32 |
| SHA-1 | 160 | 40 |
| SHA-256 | 256 | 64 |
| SHA-384 | 384 | 96 |
| SHA-512 | 512 | 128 |
Paste a 64-character hash and there is only one thing it can be.
What "broken" means
MD5 and SHA-1 are broken in a specific sense worth being precise about.
Nobody can reverse them. What became possible — in 2004 for MD5, and demonstrated for SHA-1 in 2017 — is producing collisions on purpose: constructing two different inputs that share a digest. For MD5 this now takes seconds on ordinary hardware.
The consequence is narrow but important. A matching MD5 no longer proves a file is the one that was published, because an attacker who controls both files can make them match. It still proves the file did not get corrupted in transit, because random corruption will not land on a collision.
So: MD5 for accidents, SHA-256 for adversaries.
Hashes are not password storage
This is the mistake with real consequences.
Every algorithm on this page is designed to be fast, and speed is exactly wrong for passwords. A commodity GPU tries billions of SHA-256 candidates per second, so a leaked table of SHA-256 password hashes is cracked at a rate limited only by how weak the passwords were.
Password storage wants a function that is deliberately expensive and salted per user — bcrypt, scrypt or Argon2. All three take a work factor you raise as hardware improves. None of them belongs in a browser tab, which is why this tool does not offer them.
Where the digests come from
The SHA family is computed by the browser's own Web Crypto implementation. MD5 is not part of that API — deliberately, since it is obsolete — so it is implemented on this page, in about eighty lines, and verified against the RFC 1321 test suite plus independently generated vectors at the 55, 56, 57, 64, 128 and 1000-byte boundaries where padding bugs hide.
How it works
- 1
Type or paste your input
Every digest recalculates on each keystroke. Text is converted to UTF-8 bytes first, so accented characters and non-Latin scripts hash to the same values any other correct implementation would produce. This MD5 hash generator runs in your tab — nothing is transmitted, which matters when the string is a secret.
- 2
Take whichever digest you need
All five are shown at once rather than behind a dropdown, because comparing two of them is the common case. Each has a copy button. MD5 and SHA-1 carry a standing warning: both are broken for security and are fine only for spotting accidental corruption.
- 3
Check a hash you were given
Paste the checksum from a release page into the compare box. It says which algorithm the hash is, whether it matches your input, and — when it does not — whether the length was right, which separates "wrong file" from "wrong algorithm".
Frequently asked questions
- What does an MD5 hash generator actually do?
- It runs the MD5 algorithm over the bytes of your input and returns a 128-bit digest as 32 hexadecimal characters. The same input always gives the same digest, and any change to the input — a single bit — changes it completely. It is one-way: there is no operation that recovers the input from the hash.
- Can you reverse or decrypt an MD5 hash?
- No, and any site offering to is doing something else. Hashing is not encryption and there is no key. What those services actually do is look the hash up in a precomputed table of common inputs, which works for "password123" and fails for anything you have not seen before.
- Is MD5 still safe to use?
- Not for anything security-related. Practical collision attacks against MD5 have existed since 2004, so two different files can be constructed to share a digest — which means a matching MD5 does not prove a file is the one that was published. It remains perfectly good at detecting accidental corruption in transfer, which is what most checksums are for.
- What about SHA-1?
- Also broken. A real collision was demonstrated in 2017, and browsers and certificate authorities stopped trusting it years ago. Treat it the same way as MD5: fine for a checksum, unfit for anything where an adversary might be choosing the input.
- Which algorithm should I use?
- SHA-256 for anything security-relevant, and it is the default expectation for release checksums. SHA-512 is not meaningfully more secure for this purpose but is faster on 64-bit hardware. Use MD5 only when something you cannot change requires it.
- How do I verify a downloaded file?
- Compare the checksum published by the project against one you compute locally. This tool hashes text rather than files, so it is the right tool for verifying a string, a token or a config value; for a file, use shasum -a 256 on macOS or Linux, or Get-FileHash in PowerShell, and paste the result into the compare box above to confirm which algorithm it is.
- Is this the same as a sha256 hash generator?
- It includes one. Rather than a separate page per algorithm, everything is computed together — a sha256 hash generator and an MD5 hash generator are the same operation over different constants, and having both on screen is what makes comparing a published checksum quick.
- Why does a sha1 hash generator give 40 characters and SHA-256 give 64?
- Because the digest lengths differ: SHA-1 is 160 bits and SHA-256 is 256, which is 40 and 64 hex characters respectively. That length is how the compare box identifies a pasted hash — a sha1 hash generator output is unmistakable at 40 characters, and MD5 at 32.
- Can I generate a bcrypt hash here?
- No, deliberately. bcrypt is a password-hashing function with a tunable work factor and a random salt, not a digest — it is designed to be slow, and every run produces a different output. It also belongs on your server rather than in a browser tab. Use your language's bcrypt library.
- Can I hash a password with SHA-256?
- You can, and you should not. Fast hashes are the wrong tool for passwords precisely because they are fast: commodity hardware tries billions of SHA-256 guesses per second. Password storage needs bcrypt, scrypt or Argon2, which are deliberately expensive to compute.
- What is a hash collision?
- Two different inputs producing the same digest. They exist for every hash function, because the input space is infinite and the output space is not — what matters is whether anyone can find one deliberately. For MD5 and SHA-1 they can, in seconds. For SHA-256 nobody has.
- Do you send what I type to a server?
- No. The digests are computed in your browser — SHA through the built-in Web Crypto API, MD5 through a small implementation on the page. Nothing is transmitted, nothing is logged, and there is no account. Disconnect from the internet and it still works.
- Why is this free, and what is Tekk?
- Tekk is a spec-driven development platform for people building software with AI coding agents. This tool costs us nothing to run, and the developers checking a digest against a release page are the people we build for. No signup, no run limit, no upsell inside the tool.
Want a real spec for what you’re building?
Drop a sentence. Tekk grounds it in your actual code and turns it into an executable plan.
Free to try · Connect GitHub during signup