ToolKitlyHash Generator
Type text and get MD5, SHA-1, SHA-256 and SHA-512 at the same time. Useful for verifying checksums and comparing a value against one someone else gave you.
- MD5
- SHA-1
- SHA-256
- SHA-512
MD5 and SHA-1 are broken for security purposes. Use them only for checksums and legacy compatibility, never for passwords or signatures.
All processing happens in your browser. Files are never uploaded to a server.
At a glance
- Processing
- In your browser - nothing is uploaded
- Price
- Free, no account
How to use
Type or paste your text into the input box.
All four hashes update as you type.
Switch to uppercase if the value you are comparing against uses it.
Copy the hash you need.
Frequently asked questions
Which hash should I use?
SHA-256 for anything new. MD5 and SHA-1 are only appropriate for checking file integrity against a published checksum or for compatibility with older systems that already use them.
Why are MD5 and SHA-1 considered broken?
Practical collision attacks exist for both, meaning an attacker can construct two different inputs with the same hash. That defeats their use in signatures and certificates. It does not affect their usefulness as simple checksums against accidental corruption.
Can a hash be reversed?
Not directly - hashing is one-way. But short or common inputs can be found by brute force or rainbow tables, which is why passwords must never be stored as a plain MD5 or SHA hash. Password storage needs a slow, salted algorithm such as bcrypt, scrypt or Argon2.
Why does my hash differ from another tool?
Almost always a difference in the exact input. A trailing newline, different line endings (CRLF vs LF), leading spaces or a different text encoding all produce a completely different hash. This tool hashes the UTF-8 bytes of exactly what is in the box.
Does this handle non-English text?
Yes. Input is encoded as UTF-8 before hashing, so Chinese, emoji and accented characters produce the same hash any standards-compliant tool would.
Is my text sent to a server?
No. SHA hashes use the browser built-in crypto API and MD5 runs as local JavaScript. Your text never leaves the page.