What is a hash function?
A hash function takes any input and produces a fixed-length string of characters — the same input always produces the same hash, but even a tiny change to the input produces a completely different hash. Hashes are one-way: you can't reconstruct the original input from the hash alone.
MD5 vs. SHA — which should I use?
MD5 and SHA-1 are both considered cryptographically broken — collisions (two different inputs producing the same hash) have been demonstrated for both, so neither should be used for password storage, digital signatures, or anywhere security matters. They're still useful for non-security purposes like file-integrity checksums or generating a quick fingerprint of some text. For anything security-sensitive, use SHA-256 or SHA-512 — no practical collision attack is known against either.
Common uses
- File integrity checks — compare a downloaded file's hash against a published checksum to confirm it wasn't corrupted or tampered with.
- Detecting duplicate or changed content — hash two pieces of text and compare the output instead of comparing the full text.
- Cache keys and content addressing — using a hash of content as its identifier (e.g. Git commit hashes use SHA-1).
Frequently asked questions
Is MD5 safe to use for passwords?
No. MD5 is fast to compute, which is exactly the wrong property for password hashing — it makes brute-force attacks cheap. Use a dedicated password-hashing algorithm like bcrypt, scrypt, or Argon2 instead, which are deliberately slow and salted.
Does this tool generate bcrypt hashes?
No. bcrypt (and similar algorithms like scrypt and Argon2) work differently from MD5 or SHA — they require a random salt and a configurable work factor, and are deliberately slow, so there's no single "the bcrypt hash of X" the way there's a single MD5 or SHA-256 hash. That built-in randomness and cost is exactly what makes them suitable for password storage. This tool sticks to the fixed, deterministic hash functions Web Crypto supports natively.
Does this tool generate NTLM or NT hashes?
Not currently. An NT hash (used by Windows) is MD4 of the password encoded as UTF-16LE, and NTLM authentication is a challenge-response protocol built on top of that hash — not something computed in isolation the same way as MD5 or SHA-256. Both are outside what this tool supports today.
Why does this tool compute the hash in my browser?
SHA-1/256/384/512 use the Web Crypto API's crypto.subtle.digest(), built into every modern browser. MD5 (not implemented by SubtleCrypto, since it's deprecated for security use) uses a small local implementation. Either way, the text you type never leaves your browser.
What's the difference between SHA-256 and SHA-512?
Both are part of the SHA-2 family and are considered secure. SHA-512 produces a longer output (512 bits vs. 256) and is often faster on 64-bit systems despite doing more work per block, due to how its internal word size lines up with 64-bit CPU registers.