MD5
Fast 128-bit hash, widely used for checksums and legacy compatibility.
SHA-1
160-bit hash, deprecated for security but still common.
SHA-256
256-bit SHA-2 hash, the current standard for security.
SHA-512
512-bit SHA-2 hash with larger output and higher security margin.
HMAC
Keyed hash (HMAC) with SHA-1, SHA-256 or SHA-512 — for signatures, webhooks and integrity checks.
bcrypt
Adaptive password hashing with configurable cost (salt + rounds).
What is a hash function?
A cryptographic hash function turns any input into a fixed-length fingerprint — a digest — that cannot be reversed. The same input always produces the same hash, but even a one-character change produces a completely different result (the avalanche effect). Hashes are used for integrity checks, digital signatures, password storage, cache keys and content addressing.
This generator supports MD5 and SHA-1 (fast but cryptographically broken), SHA-256 and SHA-512 (the modern SHA-2 family), and bcrypt (an adaptive password hashing algorithm with a salt and configurable cost). For files and checksums use SHA-256; for passwords use bcrypt — never MD5.
How to use the hash generator
- Open the algorithm you need: MD5, SHA-1, SHA-256, SHA-512 or bcrypt.
- Type or paste the text you want to hash into the input field.
- Click Generate to compute the digest — length and timing are shown next to the result.
- Copy the hash, or paste an existing bcrypt hash to verify a password against it.
Frequently asked questions about hashing
Which hash algorithm should I use?
Use SHA-256 or SHA-512 for integrity checks, file checksums and digital signatures. Use bcrypt, scrypt or Argon2 for passwords. MD5 and SHA-1 are broken for security purposes and should only be kept for legacy compatibility.
Can hashes be decrypted?
No. Hashing is a one-way function — there is no key that decrypts a digest. Attackers use rainbow tables and brute force instead, which is why passwords must be salted (bcrypt does this automatically).
Does this tool store what I hash?
No. All hashing runs locally in your browser and your input never leaves the device, so it is safe for passwords, keys and other sensitive strings. Note that bcrypt is computed in JavaScript here and is intentionally slower than a native implementation.
Why do I get a different bcrypt hash for the same text?
bcrypt generates a fresh random salt for every hash and stores that salt inside the resulting string. Hashing the same password twice therefore gives two different-looking results — both are valid and verify correctly.
What does the length column mean?
It shows the size of the digest in hexadecimal characters: MD5 is 32, SHA-1 is 40, SHA-256 is 64 and SHA-512 is 128. The bcrypt output is a 60-character modular crypt string that embeds the version, cost and salt.
Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
