Hash Generator

Hash a string with MD5, SHA-1, SHA-256, SHA-512, or bcrypt. Compare two hashes side by side.

SHA-256 · no output
Type input above.

01 — Overview

How the Hash Generator works

Hash arbitrary input with the most common algorithms. SHA family uses the Web Crypto API; MD5 uses spark-md5; bcrypt uses bcryptjs with configurable cost. Everything runs in the browser. Compare-mode shows two inputs side by side to verify a match.

02 — Use cases

When to use the Hash Generator

  1. 01

    Verify a download checksum against an SHA-256 hash

  2. 02

    Generate a bcrypt hash for seeding a test user

  3. 03

    Get the SHA-1 of a string for cache busting or ETag generation

  4. 04

    Compare two hashes without copy-pasting them into a diff tool

03 — Examples

Hash Generator examples

hello world (sha-256)

ex 01

b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

Canonical SHA-256 of the classic test string.

hunter2 (bcrypt, cost 10)

ex 02

$2a$10$N9qo8uLOickgx2ZMRZoMye...

Bcrypt hash with a fresh salt — re-run produces a different hash.

(empty string), SHA-256

ex 03

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

A useful constant to recognise — it means you hashed nothing by mistake.

abc, SHA-256

ex 04

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

The test vector published with FIPS 180-4, handy for checking an implementation.

04 — FAQ

Hash — frequently asked questions

When should I use bcrypt vs SHA-256?

Use bcrypt (or argon2) for passwords — it's deliberately slow and salts each hash to resist brute force. Use SHA-256 for checksums, signatures, and deduplication where speed matters.

Is MD5 broken?

For collision resistance, yes — don't use MD5 for signatures. For non-security uses (cache keys, ETags, file fingerprints) it's fine and faster than SHA.

Does my input leave the browser?

No. All hashing uses Web Crypto or in-browser libraries (spark-md5, bcryptjs). Inputs never hit a server.

What's a salt, and does this tool add one?

A salt is random data mixed into the input so that identical passwords produce different hashes, which defeats precomputed rainbow tables. bcrypt generates a salt automatically and stores it inside the output string — that's why re-hashing the same password gives a different result each time. The SHA algorithms have no salt at all.

How do I verify a downloaded file's checksum?

Hash the file with the algorithm the publisher used — usually SHA-256 — and compare the result against the value they published. Use compare mode to check the two strings rather than eyeballing 64 hex characters, which is exactly the kind of comparison human beings are bad at.

What bcrypt cost factor should I use?

Pick the highest value your hardware can absorb while keeping login under about 250ms — in practice 10 to 12 on current servers. Each increment doubles the work. The cost is stored in the hash itself, so you can raise it later and re-hash users as they log in.

05 — Reference

Specs and further reading

The primary sources this tool follows. Where behaviour is defined by a specification, we link the specification rather than a summary of it.

07 — More

Tools that pair with Hash

Password Generator

Generate strong random passwords or memorable passphrases. Length, character classes, bulk mode — all local.

Identity/password

UUID Generator

Generate UUIDs (v1, v4, v7, v8) in bulk, with format options and a validator. Cryptographically random by default.

Data/uuid

JWT Encoder & Decoder

Decode any JWT and inspect its header, payload, and signature. Encode new tokens with HS256, RS256, and more.

Auth/jwt

Last updated .