Skip to content

Hash Generator

Pure frontend: enter text, tick the algorithms, get MD5 / SHA-1 / SHA-256 / SHA-384 / SHA-512 instantly. Nothing leaves your browser — no network call, nothing recorded.

How to use

Type or paste text below, tick the algorithms you want (multiple allowed), click Compute, and the hexadecimal digest appears per algorithm. Everything runs locally in your browser.

What hashing is actually for in ops

Hashing is not a party trick; it underpins several daily tasks:

  • File integrity: after downloading an installer, image, or backup, compare the publisher's SHA-256 to confirm it was not corrupted or swapped.
  • Log and config fingerprinting: hash a log blob or config; the same content yields the same digest, a tiny change yields a completely different one — great for quick comparison and deduplication.
  • API signing: many APIs concatenate request parameters and hash them as a signature to prevent tampering; the server recomputes the same way to verify.
  • Cache keys and dedupe: hash a long URL or long text into a short key for caches or bloom filters.

MD5 and SHA-1 still work, but with a boundary

Be precise so you do not misuse them:

  • Integrity checks: still fine. You only want to know "did the file break in transit". MD5 is fast and collisions are irrelevant here — an attacker cannot replace your download and keep the MD5 identical at that moment.
  • Security contexts: do not use them. For tamper-proofing, digital signatures, or password storage, both MD5 and SHA-1 can be collided cheaply. Move to SHA-256 or above.
  • Never hash passwords directly. Even SHA-256 of a password falls to rainbow tables. Passwords need a salted slow hash (bcrypt, scrypt, Argon2). This tool does not handle passwords — do not paste them in.

One line: hashing as a fingerprint starts at SHA-256; hashing as a password belongs to a dedicated slow hash.

Three traps people hit first

Encoding mismatch: the same Chinese sentence under UTF-8 and GBK produces different bytes, hence different hashes. Modern systems default to UTF-8, but legacy systems, Windows Notepad, and some database drivers may not. Agree on encoding before comparing.

Trailing newline: you finish typing and hit Enter, the string gains a \n, the bytes change, the hash changes completely. Copy-paste also drags in leading or trailing whitespace. Compare at the byte level — trim or handle newlines explicitly.

Case and format: a hash is just hex; upper vs lower case is presentation only and means the same thing. But some systems want a 0x prefix, others want it stripped. Watch the format when pasting for comparison. This tool emits lowercase, no prefix, no spaces.

Do not paste huge files

This tool hashes the whole text in the browser; a few MB is fine, but a tens-of-MB file will choke the text box. For large files use the system command:

# Linux / macOS
sha256sum ops-backup.tar.gz
md5sum ops-backup.tar.gz

# Windows (PowerShell)
Get-FileHash -Algorithm SHA256 ops-backup.tar.gz

Compare that output character by character with the publisher's checksum.

Algorithm cheat sheet

Algorithm Output length Security status Typical use
MD5 128 bits (32 hex) Broken, integrity only Legacy compat, quick fingerprint
SHA-1 160 bits (40 hex) Broken Legacy Git objects, old systems
SHA-256 256 bits (64 hex) Safe File checks, signatures, blockchains
SHA-384 384 bits (96 hex) Safe High-security contexts
SHA-512 512 bits (128 hex) Safe High-security, long digests

Longer output means lower collision odds but slightly more compute. SHA-256 is the sweet spot for daily file checks; if you only need a rough fingerprint and performance is critical, MD5 still works, but never treat it as a security guarantee.

A concrete example

Take the text ops-jiunotes (UTF-8):

  • MD5: 8f4d0a7c9b1e2f3a4b5c6d7e8f9a0b1c (illustrative; the tool gives the real value)
  • SHA-256: 3a7b... (64 hex characters)

Change any single byte — even just the case of one character — and the digest changes completely. That is the avalanche effect: a tiny input change produces a totally different output. Verify it here: turn ops-jiunotes into Ops-Jiunotes and watch the digests diverge.

HMAC: hashing with a key

When bare hashing is not enough, use HMAC (Hash-based Message Authentication Code). It folds a secret key into the hash so the result proves both integrity and identity — only a party holding the same key can produce a matching HMAC. Many API signatures (AWS SigV4, various webhook verifiers) are HMAC-SHA256 underneath.

This tool only does bare hashing and never touches keys. For HMAC, use a server-side or local script with the proper library, and never paste the key into a web page.

Using it in CI and Git

  • Pre-commit check: in the pipeline, run sha256sum config.json to produce a checksum file, then recompute on deploy to catch silent changes in transit or at rest.
  • Git objects: Git addresses every object (blob/tree/commit) by its SHA-1 hash. That is why changing one character lets Git pinpoint exactly what moved. Git is migrating toward SHA-256 backends precisely because of SHA-1 collision concerns.
  • Cache stampede protection: hash request parameters into a short key; identical parameters hit the cache and spare the backend.

Hashing is deterministic, and that matters

Same input, same algorithm, same encoding: the hash is always identical. That is both the strength and the trap. The strength: you can compare freely. The trap: a hash does not hide information. If the input space is small (say a 4-character password), an attacker precomputes hashes of every possibility into a dictionary or rainbow table and reverses it. That is why passwords are never hashed directly — they must be salted and run through a slow hash so precomputation stops paying off.

As a side note, a collision is two different inputs producing the same digest; a sound algorithm makes that computationally infeasible. MD5 and SHA-1 are proven to collide cheaply, while SHA-256 has no known practical collision today — exactly why security contexts must move up the algorithm ladder.

When choosing an algorithm, pick by what you are protecting rather than by habit: a quick local fingerprint can be MD5, but anything that touches trust or identity must be SHA-256 or above.