Hash Generator: SHA-256, SHA-512, SHA-1 and MD5

Type a text to get its SHA-256, SHA-512, SHA-1 and MD5 hashes, and check them against an expected checksum.

SHA-256, SHA-512, SHA-1 and MD5 hashes of a text: how it works

On every keystroke the tool computes four hashes of the text you type: SHA-256 (64 hex characters), SHA-512 (128), SHA-1 (40) and MD5 (32). The three SHA hashes use the browser's Web Crypto API on the UTF-8 encoded text, and a check field tells you which algorithm matches a pasted hash. No keyed HMAC function is offered.

How it works

  • SHA-256, SHA-512 and SHA-1: crypto.subtle.digest on the UTF-8 bytes of the text, output in lowercase hex (uppercase optional).
  • MD5: a JavaScript implementation bundled with the page.
  • Check: the pasted hash is trimmed, compared case-insensitively with the four results, and the matching algorithm is named.
  • Only text is hashed; to verify a downloaded file, use sha256sum or Get-FileHash.

Example

The text abc gives the SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, the test value published with the standard. Changing a single character changes the whole hash.

MD5 and accented characters

Like the SHA functions, MD5 works on the UTF-8 bytes of the text. For abc it gives 900150983cd24fb0d6963f7d28e17f72, the RFC 1321 test value, and accented text gives the same result as md5sum on a UTF-8 file, so the check field recognises a published MD5 checksum.

Security limits

  • MD5 and SHA-1 are vulnerable to collision attacks and are unfit for signatures or certificates.
  • None of these functions, SHA-256 included, should be used to store passwords: they are fast and unsalted. Use Argon2, scrypt or bcrypt.
  • The tool computes no HMAC, as there is no field for a secret key.

Sources and dates: NIST FIPS 180-4 (Secure Hash Standard, August 2015); NIST announcement of 15 December 2022 phasing out SHA-1 by 31 December 2030; RFC 6151 (March 2011) on MD5 weaknesses (checked 14/10/2026).

Frequently Asked Questions

Can SHA-256 be used to hash passwords?

No. SHA-256 is designed to be fast, which helps brute-force attacks, and the tool adds no salt. For passwords use a slow, salted function such as Argon2, scrypt or bcrypt.

Are MD5 and SHA-1 still secure?

Not for security: both have practical collisions, and NIST has scheduled SHA-1 to be phased out by 31 December 2030. They can still detect accidental corruption, not deliberate tampering.

Why does the MD5 shown differ from my command line?

Usually the command also hashes the trailing newline: echo abc | md5sum gives 0bee89b07a248e27c83fc3d5951213c1, while printf abc | md5sum gives 900150983cd24fb0d6963f7d28e17f72, like the tool. Also check the encoding: the tool hashes the text as UTF-8.

How do I check a checksum with this tool?

Type the text, then paste the expected hash into the check field. The tool compares it case-insensitively with the four computed hashes and names the matching algorithm. It does not hash files; for a file, use sha256sum or Get-FileHash.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.