What Is a Cryptographic Hash Function?
A cryptographic hash function takes input of any length and produces a fixed-length output, called a digest, with three properties: the same input always produces the same output, a tiny change in input produces a completely different output (the avalanche effect), and there is no practical way to reverse the digest back into the original input. This hash generator computes MD5, SHA-1, SHA-256, and SHA-512 simultaneously, so pasting text to hash gives you all four digests at once instead of picking one algorithm and hoping it is the one you need. It works equally well as a dedicated md5 hash generator or sha1 generator, and since everything runs in the browser, it is a genuine sha256 online and md5 online tool, a hash generator online you can use for a quick check without installing anything.
MD5 vs SHA-1 vs SHA-256 vs SHA-512
MD5 (RFC 1321, 1992) produces a 128-bit digest, 32 hex characters. SHA-1 (FIPS 180-4) produces a 160-bit digest, 40 hex characters. SHA-256 and SHA-512 (the SHA-2 family, also FIPS 180-4) produce 256-bit and 512-bit digests, 64 and 128 hex characters respectively. Digest length alone often identifies which algorithm produced an unfamiliar hash: a 32-character hex string is MD5, a 40-character one is SHA-1, and so on.
| Algorithm | Digest length | Collision attack demonstrated | Recommended for new security use |
|---|---|---|---|
| MD5 | 128 bits (32 hex chars) | Yes (2004) | No |
| SHA-1 | 160 bits (40 hex chars) | Yes (2017) | No |
| SHA-256 | 256 bits (64 hex chars) | No known practical attack | Yes |
| SHA-512 | 512 bits (128 hex chars) | No known practical attack | Yes |
Why MD5 and SHA-1 Are Broken for Security Use
MD5 is not secure for adversarial use. A practical collision attack (two different inputs producing the same hash) was demonstrated in 2004, and faster methods have followed since, which is exactly why md5 is not secure anymore for anything an attacker might target. Hash collision explained simply: it means two different pieces of input produce the identical digest, defeating the entire point of using a hash to prove uniqueness or detect tampering. SHA-1 held up longer, but Google and CWI Amsterdam demonstrated a practical collision in 2017, the "SHAttered" attack, after which major browsers and certificate authorities deprecated SHA-1 for TLS certificates. Neither algorithm is broken for everyday, non-adversarial checksums, where nobody is deliberately trying to engineer a collision, but weighing md5 vs sha256 for anything security-relevant today, sha256 is the correct default.
Hex vs Base64 Digest Output
The underlying bytes of a digest are identical either way; hex and Base64 are purely different representations of the same output. Hex uses 2 characters per byte and is what most command-line tools (md5sum, sha256sum) default to. Base64 uses roughly 1.33 characters per byte, shorter but not as immediately readable, and is what some APIs and HTTP headers expect. This tool lets you switch between the two without recomputing anything, working as a sha256 online tool and a sha512 online tool at the same time since both digests are computed together.
What This Tool Does Not Do
This tool hashes text, not files directly (the File Checksum Calculator handles that). It computes plain, unkeyed hashes only, without a salt or key, so for password storage the correct tool is a purpose-built slow function like bcrypt, and for keyed integrity checks the correct construction is HMAC, not a raw hash of a concatenated secret and message. Nothing typed here is uploaded. SHA-1/256/512 run through the browser's native Web Crypto API, and MD5 runs through a local JavaScript implementation, since MD5 has no Web Crypto API method at all.