Unix Crypt Generator
Generate a salted /etc/shadow password hash for Linux.
How to use the Unix Crypt Generator
- Enter the password you want to hash.
- Leave the scheme on SHA-512 crypt ($6$) unless the target system needs an older one.
- Click Generate and paste the hash into /etc/shadow, your Ansible variable or your cloud-init file.
About the Unix Crypt Generator
These are the hashes that live in /etc/shadow on Linux. The format is $id$salt$hash, and the id tells you which scheme produced it: $1$ is MD5-crypt, $5$ is SHA-256 crypt, and $6$ is SHA-512 crypt. SHA-512 crypt ($6$) is the default on most modern Linux distributions, which is why it is the default here too — if you are writing a hash into a modern system, that is almost certainly the one you want.
MD5-crypt deserves a note, because its name misleads people constantly. It was designed by Poul-Henning Kamp for FreeBSD, and despite the name it is not a plain MD5 of your password — it applies MD5 many times over with a salt mixed in, precisely to slow attackers down. A $1$ hash and a bare MD5 hash are entirely different things and are not interchangeable. It is still the weakest of the three here, and only worth choosing when an old system leaves you no option.
All three schemes are salted, so the output differs every run — that is correct, not a bug. The salt sits in the middle of the string so the system can read it back when checking a login. These are far better than a raw unsalted hash, but for a new application they are still the weaker choice, because they are not memory-hard: they cost CPU time but very little RAM, so GPU attacks scale well against them. Prefer bcrypt or Argon2 there. Where crypt hashes genuinely shine is systems work — scripting user creation, Ansible user tasks, cloud-init passwd fields and Docker images, where the OS expects this exact format and nothing else will do.
Frequently asked questions
What do $1$, $5$ and $6$ mean?
They are scheme identifiers at the start of the hash: $1$ is MD5-crypt, $5$ is SHA-256 crypt and $6$ is SHA-512 crypt. The salt follows, then the hash itself, separated by dollar signs.
Why does the hash change every time I click Generate?
Because a fresh random salt is generated each run and mixed in. Both hashes are valid for the same password — the salt is stored inside the string so the system can verify a login later.
Is $1$ the same as an MD5 hash?
No, and this trips people up. MD5-crypt was designed by Poul-Henning Kamp for FreeBSD and applies MD5 many times with a salt. It is not a plain MD5 of your password, and the two are not interchangeable.
Which one should I pick?
SHA-512 crypt ($6$) — it is the default on most modern Linux distributions. Drop to $5$ or $1$ only if you are targeting an older system that requires it.
Should I use crypt hashes in my web app?
No. They are salted and much better than a raw hash, but they are not memory-hard, so GPUs attack them efficiently. Use bcrypt or Argon2 for application passwords and keep crypt for /etc/shadow and system provisioning.
Is my password stored?
No. It is sent to our server to be hashed, because browsers cannot compute crypt, then hashed and discarded immediately — never logged, never stored. For a real production account password, running mkpasswd on your own machine is still the safest habit.