Online hash generator for MD5, SHA-256 & bcrypt
Generate cryptographic hashes from any text or password, add a salt, compare algorithms side by side, and verify bcrypt hashes. Everything is computed locally in your browser — no uploads, no logs, no accounts.
Need bcrypt, PBKDF2 or HMAC? Use the bcrypt generator, the password hash generator or the SHA-256 calculator.
Choose a hash tool
Each tool below is a dedicated page with its own options, worked examples and reference notes. All of them run offline once loaded.
What a hash function actually does
A cryptographic hash function takes an input of any length and returns a fixed-length fingerprint. The same input always produces the same output, a single changed character produces a completely different output, and there is no practical way to run the process backwards. That one-way property is why hashes are used to store passwords, verify downloads, sign API requests and detect tampering in log files or blockchains.
What differs between algorithms is speed and resistance to attack. MD5 and SHA-1 are fast and broken for security purposes — collisions can be produced on demand. SHA-256 and SHA-512 remain sound as general-purpose digests. Password hashing needs the opposite of speed: bcrypt, scrypt and Argon2 are deliberately slow and memory-hungry so that an attacker who steals your database can only test a few thousand guesses per second instead of billions.
Why salt matters
Without a salt, every user who chose the same password gets the same hash. An attacker cracks it once and unlocks every matching account, and precomputed rainbow tables cover billions of common passwords instantly. A salt is a unique random string stored alongside the hash and mixed into the input before hashing, so identical passwords produce different digests and precomputation becomes useless.
Salts are not secrets — bcrypt embeds its salt directly in the hash string. What they must be is unique per record and long enough (16 bytes of random data is standard). If you also want a value the attacker does not get from the database, that is a pepper: an application-level secret kept in configuration, not in the same table.
Algorithm comparison
| Algorithm | Output | Built-in salt | Use for passwords? | Typical use |
|---|---|---|---|---|
| MD5 | 128-bit / 32 hex | No | Never | Legacy checksums, cache keys |
| SHA-1 | 160-bit / 40 hex | No | Never | Legacy Git object IDs |
| SHA-256 | 256-bit / 64 hex | No | Only with PBKDF2 | Integrity, signatures, HMAC |
| SHA-512 | 512-bit / 128 hex | No | Only with PBKDF2 | Integrity on 64-bit systems |
| PBKDF2-SHA256 | Configurable | You supply it | Acceptable | FIPS environments, key derivation |
| bcrypt | 60-char $2a$ string | Yes | Recommended | Password storage |
Frequently asked questions
{{ f.q }}
{{ f.a }}