Hash Generator

Cryptographic hash functions are fundamental to security engineering. From verifying file downloads to storing passwords (incorrectly) to signing API requests, hashes appear constantly in production systems. This tool computes them instantly in your browser.

What is a hash function?

A hash function takes an input of any size and produces a fixed-size output (the digest) that is deterministic, fast to compute, and practically impossible to reverse. Two different inputs that produce the same output is called a collision — modern hash functions are designed to make collisions computationally infeasible.

Choosing the right algorithm

- **MD5**: 128-bit digest. Cryptographically broken since 2004 — collisions can be generated in seconds. Use only for non-security checksums (e.g., cache keys, ETags) where collision resistance doesn't matter. - **SHA-1**: 160-bit digest. Also compromised by chosen-prefix collision attacks (2020). Deprecated by major CAs and NIST. Avoid for new code. - **SHA-256**: 256-bit digest. Current gold standard. Used in TLS certificates, code signing, Bitcoin, and most modern security systems. Use this unless you have a specific reason for a different algorithm. - **SHA-384**: A truncated SHA-512. Useful when the spec calls for it (some banking APIs, HMAC-SHA384). - **SHA-512**: 512-bit digest. Marginally stronger than SHA-256 on 64-bit hardware.

File hashing

All hashing runs in the browser using the Web Crypto API — a native, hardware-accelerated cryptography library built into every modern browser. When you hash a file here, it is never uploaded; the FileReader API reads it locally and feeds it to the hash function.

Practical use cases

- Verifying a downloaded file matches the publisher's checksum - Generating unique keys for caching (content-addressable storage) - Computing the HMAC base string for payment API signatures - Understanding what hash a password storage system might use