# Hash Generator

> Hash a string with MD5, SHA-1, SHA-256, SHA-512, or bcrypt. Compare two hashes side by side.

- URL: https://generate.now/hash
- Category: auth
- Price: free, no account required
- AI-powered: no
- Last updated: 2026-08-27

## What it does

Hash arbitrary input with the most common algorithms. SHA family uses the Web Crypto API; MD5 uses spark-md5; bcrypt uses bcryptjs with configurable cost. Everything runs in the browser. Compare-mode shows two inputs side by side to verify a match.

## When to use it

- Verify a download checksum against an SHA-256 hash
- Generate a bcrypt hash for seeding a test user
- Get the SHA-1 of a string for cache busting or ETag generation
- Compare two hashes without copy-pasting them into a diff tool

## Examples

### hello world (sha-256)

```
b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
```

Canonical SHA-256 of the classic test string.

### hunter2 (bcrypt, cost 10)

```
$2a$10$N9qo8uLOickgx2ZMRZoMye...
```

Bcrypt hash with a fresh salt — re-run produces a different hash.

### (empty string), SHA-256

```
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
```

A useful constant to recognise — it means you hashed nothing by mistake.

### abc, SHA-256

```
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
```

The test vector published with FIPS 180-4, handy for checking an implementation.

## Frequently asked questions

### When should I use bcrypt vs SHA-256?

Use bcrypt (or argon2) for passwords — it's deliberately slow and salts each hash to resist brute force. Use SHA-256 for checksums, signatures, and deduplication where speed matters.

### Is MD5 broken?

For collision resistance, yes — don't use MD5 for signatures. For non-security uses (cache keys, ETags, file fingerprints) it's fine and faster than SHA.

### Does my input leave the browser?

No. All hashing uses Web Crypto or in-browser libraries (spark-md5, bcryptjs). Inputs never hit a server.

### What's a salt, and does this tool add one?

A salt is random data mixed into the input so that identical passwords produce different hashes, which defeats precomputed rainbow tables. bcrypt generates a salt automatically and stores it inside the output string — that's why re-hashing the same password gives a different result each time. The SHA algorithms have no salt at all.

### How do I verify a downloaded file's checksum?

Hash the file with the algorithm the publisher used — usually SHA-256 — and compare the result against the value they published. Use compare mode to check the two strings rather than eyeballing 64 hex characters, which is exactly the kind of comparison human beings are bad at.

### What bcrypt cost factor should I use?

Pick the highest value your hardware can absorb while keeping login under about 250ms — in practice 10 to 12 on current servers. Each increment doubles the work. The cost is stored in the hash itself, so you can raise it later and re-hash users as they log in.

## References

- [FIPS 180-4: Secure Hash Standard](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) — NIST. The specification defining SHA-1, SHA-256, SHA-384, and SHA-512.
- [SubtleCrypto.digest()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest) — MDN Web Docs. The browser API used to compute every digest locally.
- [Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) — OWASP. Why a general-purpose hash is the wrong choice for storing passwords.

## Related tools

- [Password Generator](https://generate.now/password): Generate strong random passwords or memorable passphrases. Length, character classes, bulk mode — all local.
- [UUID Generator](https://generate.now/uuid): Generate UUIDs (v1, v4, v7, v8) in bulk, with format options and a validator. Cryptographically random by default.
- [JWT Encoder & Decoder](https://generate.now/jwt): Decode any JWT and inspect its header, payload, and signature. Encode new tokens with HS256, RS256, and more.