SHA-256 / MD5 Hash Generator

Cryptographic Hash Functions

A cryptographic hash function takes any input and produces a fixed-length output (the hash or digest). The same input always produces the same output, but even a tiny change in input produces a completely different hash.

The four hash algorithms shown:

Try it: hash the word “hello”

Paste hello into the box above and you get:

• MD5: 5d41402abc4b2a76b9719d911017c592
• SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Now capitalise it to Hello, a change of exactly one bit in one byte, and SHA-256 becomes:

• SHA-256: 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

Nothing survives. That is the avalanche effect, and it is what makes a hash useful as a fingerprint: you cannot tell from two digests whether the inputs were nearly identical or completely unrelated. These are the standard values, so they double as a way to check any other tool you are using against this one.

What makes a good hash function?

• Deterministic: same input → same output, always
• One-way: computing the input from the hash is computationally infeasible
• Avalanche effect: changing one bit of input changes about half the output bits
• Collision resistance: very hard to find two inputs with the same hash

Common uses:

• File integrity checking: compare hash before and after download
• Password storage: store the hash, not the password (use bcrypt or argon2 for passwords, never plain MD5 or SHA)
• Digital signatures and certificates
• Git commit identifiers (SHA-1, moving to SHA-256)
• Blockchain transaction hashing (SHA-256)
• Signing API requests with HMAC (Hash-based Message Authentication Code), usually HMAC-SHA256

Why is MD5 broken?

A collision is two different inputs that hash to the same value, and for MD5 these can be produced in seconds on ordinary hardware. The first practical attack landed in 2004, and by 2008 researchers had used it to forge a certificate authority signature. That rules MD5 out for anything where an attacker chooses the input. It remains perfectly serviceable for non-adversarial work like spotting a corrupted download or deduplicating files, which is why Linux distributions still publish MD5 sums alongside the newer ones.

SHA-1 fell the same way, more slowly. Google demonstrated a real collision in 2017, and browsers had already stopped accepting SHA-1 certificates by then.

One thing this page cannot do

Hashing is one-way, so nothing here will turn a digest back into the original text. Sites advertising “MD5 decryption” are running a lookup table of previously hashed common strings, not reversing anything. That works depressingly well on short passwords, which is precisely why password storage needs a slow, salted algorithm rather than a fast general-purpose hash.

SHA-256 in practice

Bitcoin applies SHA-256 twice for block hashing. TLS (Transport Layer Security) 1.3 and the certificates behind every HTTPS connection depend on it. Character encoding matters for reproducibility: this page hashes the UTF-8 bytes of what you type, which is what almost every other tool does, so accented characters and emoji will match elsewhere.

That is also why the panel reports two lengths. JavaScript counts a string in UTF-16 code units, so an emoji reads as two “characters” and an accented letter can read as one or two depending on how it was typed. What actually gets hashed is the UTF-8 byte count, which is the number to quote if you are comparing against sha256sum or a hashlib call. For plain ASCII the two are identical, which is why the difference almost never surfaces until it does.

If three of the four hashes say “unavailable”, the page is running without the Web Crypto API. That happens on plain HTTP, because browsers only expose crypto.subtle in a secure context: HTTPS, or localhost. MD5 is computed in plain JavaScript here so it keeps working either way. Load the page over HTTPS and the three SHA values come back.