Hash Calculator

What is a hash?#

A cryptographic hash is a one-way fingerprint for arbitrary bytes. You feed in a message of any length and get back a fixed-length digest that behaves like a signature for that exact input: change a single bit and the output changes completely. Hashing answers two practical questions at once — “did this data change?” and “can I reference this data by a short, stable id?” — which is why it sits underneath file integrity checks, content addressing, deduplication, and password storage.

This page computes five algorithms: the SHA-2 family (SHA-256, SHA-384, SHA-512), SHA-1, and MD5. The four SHA variants run through the browser’s native Web Crypto engine (crypto.subtle.digest), the same primitive production code uses — not a JavaScript reimplementation. MD5 is not part of Web Crypto, so it is loaded on demand only when you actually select it, keeping it out of the page’s initial download.

A hash is not encryption. It is irreversible: you cannot reconstruct the input from the digest. If you need two parties to share a keyed digest, use HMAC; if you need to reverse the operation, use symmetric encryption.

How to use it#

1. Paste your input into the left pane. Anything textual — a string, a JSON blob, a config snippet. The bytes are encoded as UTF-8 before hashing.
2. Pick the algorithm:
   • SHA-256 — the modern default; 256-bit digest, used everywhere from TLS to Git to blockchain.
   • SHA-384 / SHA-512 — longer digests from the same family; choose when a spec calls for them.
   • SHA-1 — 160-bit; legacy, fine for checksums, broken for collision-resistant signatures.
   • MD5 — 128-bit; fast and ubiquitous but cryptographically broken. Useful for non-security checksums and legacy cache keys.
3. Pick the output encoding: hex (lowercase, the common convention for digests) or base64 (more compact, common in tokens).
4. Click Sample to load the canonical test string, or Clear to start over. The digest updates live in the right pane; Copy grabs it.

Key features#

• Native Web Crypto. SHA-1/256/384/512 are computed by crypto.subtle.digest — the browser’s audited implementation, not a third-party library.
• Lazy MD5. The MD5 implementation is only fetched when you select it, so it never weighs down the first render.
• Hex or base64. One-click switch with no re-typing.
• Live status line. Confirms the algorithm and the digest byte length, so a truncated or off-by-one result is obvious.
• Zero upload. Hashing happens entirely in your browser; the input never reaches a server.

Worked example#

The canonical reference string is The quick brown fox jumps over the lazy dog. With the algorithm set to SHA-256 and output hex, the digest is:

d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

The same string under SHA-1 (hex):

2fd4e1c67a2d28fced849ee1bb76e7391b93eb12

A useful edge case is the empty string. Hashing nothing at all still produces a well-defined, non-empty digest — for SHA-256 it is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, and for MD5 it is d41d8cd98f00b204e9800998ecf8427e. These empty-input vectors are also how this tool’s own test suite verifies correctness — if your output differs, the page has been tampered with.

FAQ#

SHA-256 or MD5 — which do I pick?#

SHA-256 for anything that touches security: password salting schemes, signed URLs, integrity proofs, content IDs that must resist collision attacks. MD5 is acceptable only for non-adversarial checksums (a quick “did this file change?” check, a cache key) where nobody is trying to forge a collision. If you are not sure, default to SHA-256.

Why does the same input always give the same digest?#

Hashing is deterministic — there is no random salt involved at this layer (unlike bcrypt). That determinism is the whole point of content addressing: the same bytes must always produce the same fingerprint. The flip side is that two people hashing the same secret get the same digest, which is why a plain hash is a terrible way to store passwords.

Can I recover the original from the hash?#

No. A cryptographic hash is a one-way function by design; there is no key and no inverse operation. “Decrypting a SHA-256” is a category error. The only attack is brute force (trying inputs until one matches), which is exactly what makes weak passwords dangerous even when hashed without a salt.

Why is my MD5 different from a tool I usually use?#

Almost always a byte-representation mismatch: a trailing newline, different line endings (CRLF vs LF), or the other tool hashing a UTF-16 representation while this page hashes UTF-8. Compare the raw bytes, not the on-screen text.