Hash & Security
Generate any hash you need — the classics like MD5 and SHA-256, checksums like CRC32, and real password hashes like bcrypt and Argon2. Your input is hashed and thrown away, never logged or stored.
About Hash & Security
This is the largest category on the site: thirty-six hash and checksum generators in one place. It spans the everyday cryptographic digests — MD5, SHA-256, SHA-512 and the SHA-3 family — the fast non-cryptographic checksums like CRC32 and xxHash, and the real password hashing schemes: bcrypt, Argon2 and the PHP password_hash() generator. Developers, students and anyone verifying a download end up here.
The important distinction is what a hash is for. If you are verifying that a file or a string arrived intact, a checksum is enough, and CRC32 or Adler-32 are the classic choices. If you need a cryptographic digest — a fingerprint that is impractical to forge — reach for SHA-256 or SHA-512; MD5 and SHA-1 are still everywhere in legacy systems and file checksums, but both are broken for security purposes and should not protect anything that matters. If you are storing passwords, none of the above are correct: use bcrypt or Argon2, which are deliberately slow and salted so that a stolen database is expensive to attack. The bcrypt password verifier checks a candidate against an existing hash, the HMAC generator covers signing a message with a shared key, and the all hash generator runs one input through many algorithms at once when you are trying to identify an unknown digest by its length and shape.
Every tool here is free and needs no sign-up. Be aware of how they work: unlike most of this site, these are computed on our server, because a browser cannot run bcrypt, Argon2, RIPEMD or PHP's password_hash(). Your input is sent to the server, hashed, and the result returned; the input is discarded immediately and is never stored or logged. Even so, the honest advice is simple — do not paste a real password, a live API key or genuine production data into any online hash tool, including this one. Use a sample value to learn the format, then generate the real thing on your own machine.
Frequently asked questions
Are these hashes generated in my browser?
No. Hashing here is done on our server, because browsers cannot natively run algorithms like bcrypt, Argon2, RIPEMD or PHP password_hash. Your input is sent over HTTPS, hashed, and discarded right away. It is never stored or logged. Even so, do not paste a real password or a live secret into any online hash tool.
Can a hash be reversed back into the original text?
Not by undoing the maths. Hashing is one-way. What attackers do instead is guess: they hash billions of candidate inputs and look for a match, which works well against short or common inputs hashed with a fast algorithm like MD5. That is exactly why password hashes use slow, salted schemes.
Should I still use MD5 or SHA-1?
Only for non-security purposes such as checking a file download against a published checksum, or as a cache key. Both have practical collision attacks, so never use them for signatures, certificates, passwords or anything where someone benefits from forging a match.
Why does bcrypt give me a different hash every time for the same password?
Because bcrypt generates a new random salt on each run, and the salt is stored inside the resulting hash string. That is intentional and correct. To check a password you do not compare hashes directly; you use a verifier, which reads the salt from the stored hash and recomputes with it.