Cryptography
Generate MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3, CRC32, NTLM, LM, BCrypt, RIPEMD-160, Blake2, Whirlpool, HMAC hashes, SRI tags, WordPress/Laravel password hashes, and secure random hashes. Free online hash generator with 20+ algorithms.
A hash generator is a tool that takes input data — text, files, or binary — and produces a fixed-length fingerprint called a hash using a cryptographic hash function. This online hash generator supports over 20 algorithms including MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-224/256/384/512, CRC32, NTLM, LM Hash, BCrypt, RIPEMD-160, Blake2b, Blake2s, and Whirlpool. All hashing runs locally in your browser, so your data never leaves your device.
Hashing is a one-way function: you can compute a hash from input, but you cannot reverse a hash back to its input. This makes hashing fundamental to password storage, file integrity verification, digital signatures, and malware identification. Whether you need an MD5 hash generator for legacy checksums, a SHA-256 hash generator for file verification, or a BCrypt hash generator for password security, this tool covers every use case.
Unlike encryption, which is reversible with a key, hashing is intentionally irreversible. Two different inputs should produce completely different hashes (the avalanche effect), and the same input should always produce the same hash. This determinism is what makes hashes useful for verification: if the hash matches, the data is intact.
A hash function processes input data in fixed-size blocks, applying mathematical operations that mix and scramble the bits to produce a fixed-length output. The SHA-256 algorithm, for example, processes data in 512-bit blocks and produces a 256-bit (32-byte, 64-hex-character) output. MD5 produces 128 bits, SHA-512 produces 512 bits, and SHA3-256 produces 256 bits.
The key properties of a cryptographic hash function are: determinism (same input always produces same output), quick computation (fast to hash but slow to reverse), avalanche effect (small input change causes large output change), collision resistance (hard to find two inputs with the same hash), and preimage resistance (hard to find an input that produces a given hash).
This hash generator uses the browser's native Web Crypto API for SHA-1, SHA-256, SHA-384, and SHA-512, which provides hardware-accelerated performance. MD5 and SHA3 are implemented in pure JavaScript. BCrypt uses bcryptjs, and advanced algorithms like Blake2, RIPEMD-160, and Whirlpool use hash-wasm for WebAssembly-accelerated performance.
Hashing, encryption, and encoding are often confused but serve fundamentally different purposes. Hashing is one-way and irreversible — you cannot recover the original data from a hash. Encryption is two-way and reversible with a decryption key — you can recover the original data. Encoding is also reversible but provides no security — it simply changes data representation (like Base64 or URL encoding).
Use hashing when you need to verify integrity or store passwords without revealing them. Use encryption when you need to protect data but recover it later. Use encoding when you need to transport data in a different format but security is not a concern. This tool includes a Base64 encoder/decoder tab to help you see the difference: Base64 is encoding (reversible), while SHA-256 is hashing (irreversible).
A common mistake is using encoding (like Base64) as if it were encryption. Base64-encoded data can be instantly decoded by anyone — it provides zero security. Similarly, MD5 should not be confused with a secure hash: while it produces a hash, it is cryptographically broken and should only be used for non-security checksums.
The SHA (Secure Hash Algorithm) family includes three generations: SHA-1, SHA-2, and SHA-3. SHA-1 produces a 160-bit hash but is deprecated due to known collision attacks. SHA-2 (SHA-224, SHA-256, SHA-384, SHA-512) is the current standard, widely used in TLS, SSL certificates, and blockchain. SHA-3 (SHA3-224, SHA3-256, SHA3-384, SHA3-512) uses the Keccak sponge construction and is the newest standard, designed as a future-proof alternative to SHA-2.
SHA-256 is the most commonly used hash algorithm today. It powers Bitcoin's proof-of-work, TLS certificate signatures, and software package verification. SHA-512 offers higher security margin with a 512-bit output. SHA3-256 and SHA3-512 use a completely different internal structure (sponge construction) than SHA-2, providing defense-in-depth: even if SHA-2 is broken in the future, SHA-3 would remain secure.
This hash generator supports the entire SHA family: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-224, SHA3-256, SHA3-384, and SHA3-512. Each is computed in real-time as you type, and you can toggle between uppercase and lowercase hex output.
BCrypt is a password hashing function specifically designed to be slow, making brute-force attacks expensive. Unlike fast hash functions (MD5, SHA-256), BCrypt uses a configurable cost factor that determines how many iterations are performed. A cost of 10 means 2^10 = 1,024 iterations; a cost of 12 means 4,096 iterations. This hash generator includes a BCrypt tab with an adjustable cost factor slider.
BCrypt also includes a built-in salt, which is embedded in the output hash string. The salt prevents rainbow table attacks and ensures that hashing the same password twice produces different hashes. The output format is $2a$cost$salt+hash, which can be verified later using bcrypt's compare function.
For production password storage, BCrypt is a solid choice. Other options include scrypt (memory-hard) and Argon2 (winner of the Password Hashing Competition, 2015). Never store passwords with raw SHA-256 or MD5 — these are too fast and can be brute-forced with modern GPUs at billions of hashes per second.
NTLM (NT LAN Manager) and LM (LAN Manager) hashes are used in Windows authentication, particularly in Active Directory environments. The LM hash is the older format, based on DES encryption of the uppercase password, and is completely broken — it splits passwords into two 7-character halves and can be cracked almost instantly. NTLM hash is the newer format, computed as MD4 of the UTF-16LE encoded password.
This hash generator includes an NTLM/LM tab for educational purposes. Understanding how these hashes work is important for security professionals who audit Windows environments. Tools like Hashcat and John the Ripper can crack NTLM hashes, so understanding the hash format helps you assess password policy strength.
Modern Windows environments should use Kerberos authentication instead of NTLM. However, NTLM is still present for backward compatibility and is a common target in penetration testing engagements. These hashes are for educational use only — never use them to attack systems you do not own or have authorization to test.
Hashes are the standard way to verify file integrity. When you download software, the publisher often provides a SHA-256 checksum. By computing the hash of your downloaded file and comparing it to the published checksum, you confirm the file was not corrupted or tampered with during download. This hash generator includes a file hashing tab that computes SHA-256 for any local file.
In malware analysis, file hashes (MD5, SHA-256) are used to identify samples. Threat intelligence platforms like VirusTotal use hashes as unique identifiers, and incident response teams share indicators of compromise (IOCs) as file hashes. The compare tab lets you verify whether two hashes match, which is essential for integrity checking.
Subresource Integrity (SRI) is a browser security feature that uses hashes to verify that third-party resources (scripts, stylesheets) loaded from CDNs have not been tampered with. This tool includes an SRI generator tab that creates properly formatted integrity attributes for use in HTML script and link tags.
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to prove both integrity and authenticity. Unlike a plain hash, an HMAC cannot be recomputed without the key, which makes it the right tool for signing API requests, verifying webhooks, and securing tokens. This generator's HMAC tab computes HMAC-SHA-256 and HMAC-SHA-512.
Rainbow tables are precomputed lookup tables that reverse hashes back to plaintexts. They are devastating against unsalted hashes. The defense is a salt: a unique random value added to each password before hashing. BCrypt includes salts automatically, but if you use SHA-256 for password storage, you must add and store a salt manually.
When auditing a system, check whether passwords are salted and whether a slow algorithm is used. If you find MD5 or unsalted SHA-1 in a password database, that is a critical finding, because those hashes can be cracked in seconds using wordlists and tools like John the Ripper.
WordPress uses the phpass portable hash format ($P$) for password storage. This format is based on MD5 with iterated stretching and a salt, providing moderate security for web applications. This generator's WordPress tab creates compatible hashes that can be stored in the wp_users.user_pass column and verified with wp_check_password().
Laravel uses BCrypt for password hashing by default, through PHP's password_hash() function. The Laravel tab in this generator produces hashes compatible with Laravel's Hash::make() and Hash::check() methods. You can adjust the BCrypt cost factor to match your application's security requirements.
Both WordPress and Laravel hashes include embedded salts, so the same password will produce different hashes each time. This is by design and is verified by extracting the salt from the stored hash during the check operation.
Best practice: Use SHA-256 or SHA-512 for file integrity and digital signatures. Use BCrypt (cost 12+), scrypt, or Argon2 for password storage. Use HMAC with SHA-256 for API authentication. Use SRI tags for CDN-hosted resources. Always use salts with password hashes.
Common mistakes: Using MD5 for any security purpose (it is broken). Storing passwords with raw SHA-256 (too fast, vulnerable to GPU brute-force). Forgetting to add a salt. Using the same salt for all users. Using a cost factor that is too low for BCrypt (below 10 is not recommended). Confusing encoding (Base64) with encryption or hashing.
This hash generator helps you avoid these mistakes by clearly labeling each algorithm's security level: Broken (MD5, LM), Weak (SHA-1, NTLM), or Strong (SHA-2, SHA-3, BCrypt, Blake2). Use the comparison tab to verify hashes match, and use the download button to export results for documentation.