How to Generate a SHA-256 Hash (and Why Not MD5)
2026-08-06
A cryptographic hash turns any amount of input into a short, fixed-length fingerprint. Change one character and the output changes completely and unpredictably. That property is what makes hashes useful: if two hashes match, the inputs match.
Step by step
- Open the Hash Generator.
- Paste or type the text you want to hash.
- Pick an algorithm — SHA-256 unless something specific requires otherwise.
- Copy the hex digest.
Why MD5 is not offered
MD5 was broken for collision resistance in 2004. Researchers can construct two different inputs that produce the same MD5 hash, which destroys the one guarantee that makes a hash useful for integrity checking. Browsers deliberately do not ship MD5 in their crypto APIs, and this tool follows that lead rather than shipping a hand-rolled implementation.
If you have been handed an MD5 checksum to verify, that is a signal the source is using outdated tooling — not a reason to trust the check.
Which algorithm to choose
- SHA-256 — the right default. File checksums, content addressing, API signatures, integrity checks.
- SHA-1 — only for verifying legacy systems that still emit it. It is also considered broken for collisions and should never be chosen for something new.
- SHA-384 and SHA-512 — longer digests for high-assurance use. Not more secure in practice for ordinary purposes, but harmless.
Hashing is not encryption
Hashing is one-way: there is no key and no way back. That also means a short or common input can be looked up in a precomputed table, which is exactly why passwords are salted before hashing — and why a raw SHA hash is the wrong way to store a password. Use bcrypt or Argon2 for that; they are deliberately slow.
This tool uses the Web Crypto API built into your browser, so the implementation is the audited code your browser already uses for https, and your input never crosses the network.