Skip to content
tools.best

Browse all tools

MD5 Hash Generator

Type or paste text and read its MD5, SHA-1 and SHA-256 hash, computed from the UTF-8 bytes of exactly what is in the box.

Runs in your browser. Nothing you enter is sent to a server. Sources: RFC 1321, FIPS 180-4 Updated

0 characters, 0 bytes as UTF-8. Below are the hashes of empty input.

MD5 (32 hex characters)

d41d8cd98f00b204e9800998ecf8427e

SHA-1 (40 hex characters)

da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA-256 (64 hex characters)

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

How the MD5 hash generator computes a hash

  1. The text in the box is turned into bytes as UTF-8, the same bytes the text to hex converter shows. A plain English letter or digit is one byte, é is two, € is three and an emoji is four or more. A line break in the box is one byte (LF).
  2. Those bytes go through the algorithm: MD5 as written in RFC 1321, SHA-1 and SHA-256 as written in NIST FIPS 180-4.
  3. The result is shown in hexadecimal, two characters for each byte of the hash.

Nothing is added to your text. There is no line break at the end unless you type one, and there is no salt or key. The same bytes always give the same hash, and the hash has the same length whether you enter one letter or a whole page.

A hash is not an encoding. Base64 or hex can be turned back into the text; a hash cannot. If you need a random identifier rather than a fingerprint of a text, use the UUID generator.

MD5 example: one letter changes the whole hash

Press "Load sample text". The box now holds The quick brown fox jumps over the lazy dog, which is 43 characters and 43 bytes. The results are:

  • MD5: 9e107d9d372bb6826bd81d3542a419d6
  • SHA-1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
  • SHA-256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

Change the last word from dog to cog and the MD5 becomes 1055d3e698d289f2af8663725127bd4b. One changed letter gives a completely different hash, which is what makes a hash useful for spotting changes.

MD5 of "The quick brown fox jumps over the lazy dog" is 9e107d9d372bb6826bd81d3542a419d6; with cog instead of dog it is 1055d3e698d289f2af8663725127bd4b, which matches the first hash in only 1 of 32 positions.
One changed letter changes the hash almost completely, which is what makes a hash useful for spotting changes.

MD5 test values from RFC 1321

TextBytesMD5
(empty)0d41d8cd98f00b204e9800998ecf8427e
a10cc175b9c0f1b6a831c399e269772661
abc3900150983cd24fb0d6963f7d28e17f72
message digest14f96b697d7cb7938d525a2f31aaf161d0

These four pairs are printed in the test suite of RFC 1321, appendix A.5. For abc the SHA-1 is a9993e364706816aba3e25717850c26c9cd0d89d and the SHA-256 is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Those two, and the sample text results above, match what OpenSSL returns for the same bytes.

MD5, SHA-1 and SHA-256 compared

AlgorithmHash lengthDefined inUse it for
MD5128 bits, 32 hex charactersRFC 1321Checking for accidental changes, and older systems that expect it. Not for signatures or anything an attacker could profit from forging: RFC 6151 reports that two inputs with the same MD5 can be found in about a minute on a notebook computer.
SHA-1160 bits, 40 hex charactersFIPS 180-4Older systems that expect it. NIST retired SHA-1 in December 2022, advises moving to SHA-2 or SHA-3, and will stop using it by 31 December 2030.
SHA-256256 bits, 64 hex charactersFIPS 180-4New work. It belongs to the SHA-2 family that NIST names as a replacement for SHA-1.

None of the three is suitable on its own for storing passwords. They are fast by design, so guesses can be tested quickly. See the question on passwords below.

MD5 Hash Generator: FAQ

Can an MD5 hash be decrypted?
No. A hash is not encryption: there is no key, and the 32 characters do not contain the text. What can be done is guessing. Someone hashes likely inputs and compares the results, so the hash of a short or common text, such as a simple password, can be matched quickly.
Why is my hash different from the one another tool gives?
The bytes are different, even if the text looks the same. The usual causes are a line break at the end (echo abc | md5sum hashes four bytes, because echo adds a line break), Windows line endings, a space you cannot see, or a different text encoding such as UTF-16. Compare the byte count under the box with the size of your input.
Is MD5 still safe to use?
Not where someone could gain from forging a match. Two different inputs with the same MD5 can be produced on an ordinary computer, and RFC 6151 rules MD5 out wherever collision resistance matters, digital signatures being the main example. It still shows whether a text changed by accident.
Can I hash a file here?
No, this tool hashes text only. For a file use md5sum, sha1sum or sha256sum on Linux, md5 or shasum -a 256 on macOS, and Get-FileHash in PowerShell on Windows.
Should I store passwords as MD5 or SHA-256?
No. All three functions on this page are built to be fast, which lets an attacker try a very large number of guesses. The OWASP password storage guidance recommends slow functions made for passwords: Argon2id, scrypt, bcrypt or PBKDF2.

Sources

More in Developer