Hash a Text String (SHA-256, SHA-512, MD5)

How it works

Paste your text into the left pane; the digest appears in the right pane as you type, with no button to press. Say an API's documentation asks for the SHA-256 of the word "hello" to build a signature: paste the word and the 64-digit value is there immediately. The hash is computed over the UTF-8 bytes of the text rather than the letters you see, which matters the moment your text leaves plain ASCII — an accented letter or an emoji is several bytes, and changing one of them changes the digest completely. Paste a value into the Expected digest field and the tool does the comparison for you, stating in the result line whether the two match; case differences, leading and trailing spaces and a prefix such as "sha256:" are ignored. The result line also reports the character count next to the byte count, which are two different numbers for anything outside ASCII. Everything is computed inside your browser, so the text you paste never reaches a server.

This tool is also known as sha256 hash generator, md5 hash generator, hash a string online, text to sha256, sha512 generator, compare hash values.

What is Hash (message digest)?

A hash is a fixed-length fingerprint derived from the bytes of a text. Whether you type a single word or paste a hundred-page contract, SHA-256 always returns 64 hex digits; the same input always yields the same value, and an input differing by one letter yields a completely unrelated one. Those two properties are what let you match long texts without comparing them byte by byte and prove that a text has not been edited since it was recorded. The operation is one-way: there is no path from digest back to text.

What is SHA-512?

SHA-512 is the 512-bit member of the SHA-2 family and produces 128 hex digits. It shares its design with SHA-256 but works on 64-bit words, which usually makes it faster on 64-bit processors and slower on 32-bit ones. In practice it is chosen for its length rather than its speed: deriving an HMAC key, a seed or a long block of key material benefits from 512 bits of output. For verifying downloads and archives, SHA-256 remains the de facto standard.

What is MD5?

MD5 was defined in 1992 and produces a 128-bit digest written as 32 hex digits. Its cryptographic guarantee has been broken since 2004: two different inputs sharing one MD5 digest can be produced on a laptop, so an MD5 match cannot prove that content is unmodified. It still reliably catches accidental damage — a half-copied string, a transmission error — and a great many older systems still publish MD5 values, which is why it is offered here.

Is hashing text the same as hashing a file?

The algorithm is identical; the input is not. This page converts the text you paste into UTF-8 bytes and hashes those bytes, while a file hash runs over the bytes stored on disk. The practical consequence is that typing "hello" here and hashing a text file that contains "hello" usually give different digests, because the file almost always ends with an invisible newline character. If your goal is verifying that a downloaded installer or archive arrived intact, hash the file itself: the hash generator page on this site reads the file exactly as it is and accepts inputs up to 1 GB.

When the same text gives two different digests

A hash is computed over bytes, not over the characters you can see, and three invisible differences account for almost every mismatch: a trailing newline at the end of the text, Windows writing line endings as two characters (CR LF) instead of one, and a byte-order mark stuck to the front of the text. Text copied out of a file usually brings its final newline along, so if the digest you got from the command line disagrees with the one here, check that first.

The second source is the character encoding. The same sentence produces one byte sequence in UTF-8 and a different one in Latin-1 or Windows-1252, so the digest differs as well. This tool always uses UTF-8, the default of the web and of every modern platform. If you are checking a value that came out of an older database and cannot make it agree, ask which encoding the other side is using before you doubt the algorithm.

Do not store passwords with these digests

Storing passwords as MD5 or SHA-256 digests was common practice for years and is a security defect today. The reason is speed: these algorithms are fast by design, and speed is exactly what an attacker holding a leaked digest list wants, because it lets them try billions of guesses per second. Password storage calls for bcrypt, scrypt or Argon2 — algorithms deliberately made slow and salted per record.

What this page is for is fingerprinting a piece of text: verifying a signature, checking whether two long strings are byte-for-byte identical, proving a paragraph has not been edited, or producing the digest some API expects. There is no technical risk in pasting a password here, since the text never leaves your device, but if you plan to store the resulting digest as a credential you are using the wrong tool.

• Good for: signature checks, comparing two texts, proof of no change, digests an API asks for
• Not for: storing passwords, hiding data, standing in for encryption

Frequently asked questions

How do I get the SHA-256 of a string?

Paste the string into the left pane and leave the algorithm on SHA-256; the 64-digit digest appears instantly in the right pane. It is computed with your browser's built-in crypto engine, so the string is never sent anywhere.

Can a hash be reversed back into the original text?

No. Hashing is one-way: texts of any length collapse into a fixed-length value and there is no inverse. Services advertising "hash decryption" are really looking your digest up in a precomputed dictionary of common words and leaked passwords; that works for short, common inputs and fails on a full sentence.

How do I tell whether two texts are identical?

Hash both and compare the digests, or paste one digest into the Expected digest field and put the other text in the pane. Identical digests mean the texts match character for character. If they differ, at least one byte differs — the text comparison tool on this site shows you where.

Is MD5 still usable?

Only for matching. Two different inputs can be crafted to share an MD5 digest, so an MD5 match cannot prove that content is unmodified. Verifying an MD5 value someone else published is still legitimate; when you publish a digest yourself, use SHA-256.