Hash generator

MD5, SHA family, CRC32 and MySQL5 over text or a file. The file is read in your browser.

Runs entirely in your browser. Nothing you enter here is sent to the server.

This tool needs JavaScript

It does its work in your browser, which is exactly why it cannot fall back to the server: that would mean sending your input somewhere. With scripting off there is nothing for it to run on.

Text

Input

Blurred by default, because this box usually ends up holding a password.

File

Drop a file here, or

The file is read in your browser. It is not uploaded.

Hashes

Algorithm	Value
Nothing to hash yet.

Which of these to use, and which not to

Hashing happens in your browser. SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser's own crypto engine; MD5 and CRC32 are implemented here, because no browser ships them any more — which is a hint in itself.

SHA-256, SHA-384, SHA-512: Use these. SHA-256 is the default answer when someone says "hash it".
SHA-1: Broken for anything security-related — collisions have been produced in practice. Still fine for Git object IDs and for checking a file against an old published checksum.
MD5: Badly broken. Collisions take seconds. It is here because vendors still publish MD5 checksums, so you still need to compare them.
CRC32: Not a hash at all — an error-detecting checksum. Catches a corrupted download; catches nothing deliberate.
MySQL5: What PASSWORD() produced in old MySQL: SHA1(SHA1(password)), uppercase, with a * in front. For reading ancient database dumps.
Base64: Not a hash either — it is reversible. Included because the old tool had it next to the hashes and people look for it here.

Never hash a password with these

SHA-256 is fast, and that is the problem: a graphics card tries billions of guesses a second against it. Passwords need a deliberately slow function with a salt — argon2id, scrypt or bcrypt. Those cannot be done properly in a page like this, so they are not offered here rather than offered badly.

Files are read into memory in one go, so something the size of a DVD image will make the tab unhappy. Ordinary files are fine.

Other tools

Code scanner — Read QR codes and barcodes with your camera or from an image. Every format ZXing knows.
Code generator — Make a QR code, Data Matrix, Aztec, PDF417 or a linear barcode and download it.
Link inspector — See where a link really goes before you open or shorten it: the real host, lookalike letters, hidden redirects and tracking parameters.
Base converter — Encode and decode between text and Base2 through Base85, or convert integers between any two bases.
JWT decoder — Read a JSON Web Token's header and claims, with every timestamp as a date. Decoded right here; the token is never sent or stored.
SSH key fingerprint — SHA256 and MD5 fingerprints, key type and size, and SSHFP records for a public key. Private keys are refused unread.
Password generator — Random passwords from a CSPRNG, with the character classes you pick.
TOTP generator — Turn a TOTP secret or otpauth:// link into the current code. The secret stays on your device.
Timestamp converter — Unix time to a calendar date and back, in every format at once. Live clock included.
Subnet calculator — IPv4 and IPv6: network, range, host count, masks and reverse-DNS pointers.
Image resizer — Resize and convert an image without it ever leaving your browser. Re-encoding drops EXIF and GPS.
IP info — Your public IPv4 and IPv6, as this server sees them.
PHP obfuscator — Wrap PHP so it self-decodes at runtime. Runs on the server; the code is never stored.