Hash Generator

printf '' | sha256sum

What a hash is, and what it isn't

A hash function takes any input — a word, a file, this whole paragraph — and produces a fixed-length string called a digest. The same input always produces the same digest, a tiny change to the input produces a completely different one, and (for a well-designed algorithm) there is no way to run the process backwards. That last point matters: a hash is not encryption. Encryption is reversible with the right key; hashing is one-way by design. Sites that claim to "decrypt" an MD5 hash are not reversing the algorithm — they are looking your digest up in a precomputed table of common inputs, which only works if your input was common enough to be in the table.

The trailing newline: the most common "wrong answer" report

The single most common reason a web tool's hash doesn't match a terminal command is a character neither tool shows you. Run echo "hello" | sha256sum and compare it with printf "hello" | sha256sum — they differ, because echo appends a trailing \n and printf does not. Both answers are "correct"; they are just answers to two different questions about two different byte strings. This page's byte-exactness panel shows the exact byte count and a hex preview of the first and last bytes, with a toggle for the trailing newline, so you can see — and reproduce — exactly which bytes went in.

SHA-3 is not Keccak

SHA3-256 and Keccak-256 share the same underlying permutation and differ only in one domain-separation byte in the padding (0x06 for the NIST standard versus 0x01 for the original, pre-standard Keccak). That single-byte difference produces two completely different digests for the same input. Ethereum's keccak256 uses the pre-standard padding, and several online tools mislabel its output "SHA3-256" — a wrong answer shipped as a feature. This tool computes and labels both separately.

Which algorithms are broken, for what

MD5 and SHA-1 both have practical, demonstrated collision attacks: an attacker can construct two different inputs with the same digest. That makes both unsafe for anything adversarial — a certificate, a digital signature, a software-integrity check where someone might want to forge a match. Neither is broken for a non-adversarial use, like a cache key or a checksum against accidental corruption, which is why this page states each algorithm's real status rather than a blanket "insecure" label or silence.

Why a checksum is not a hash

CRC-32, CRC-32C, Adler-32 and xxHash are checksums, not cryptographic hashes: they are built for speed and for catching accidental corruption, and none of them resists a deliberate attacker who wants to produce a matching value on purpose. Using a checksum where a cryptographic hash is required is a real security bug, so this page always labels a checksum as a checksum, never as a hash.

How to identify a digest

A digest's length narrows things down but rarely to one answer. 32 hex characters could be MD5, MD4, NTLM, a truncated longer hash, or a UUID with its dashes stripped — five genuinely different things that are all 128 bits long. The Identify tab above returns every plausible candidate with the evidence behind it (length, alphabet, any recognisable prefix like bcrypt's $2b$) rather than guessing at one, because presenting a guess as an answer is exactly the kind of overconfidence this site exists to avoid.

Why everything here is computed twice

For SHA-1, SHA-256, SHA-384 and SHA-512, this page runs our own hand-written engine and the browser's separately-written crypto.subtle implementation on the same bytes, then compares the two. Agreement between two independent implementations — one of them the browser vendor's own, audited by people who are not us — is real evidence the digest is correct. For algorithms the browser can't compute natively, the page instead runs that algorithm's own official test vectors in your tab the first time you use it, and reports the result rather than showing a badge we simply drew.

Common use cases

• Checking that a piece of text or a short string matches a known digest
• Generating a cache key, an ETag, or a non-adversarial content fingerprint
• Learning why a hash computed here doesn't match a terminal command, byte for byte
• Telling SHA3-256 apart from Keccak-256 for an Ethereum-adjacent task
• Guessing what type of digest a pasted string is, with the evidence shown