Skip to content
BeeTools— Fast. Private. Free.

Hash Generator

Runs in your browser

Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text, all at once.

Developer Tools

Input

Compare with a known digest

Paste a hash you were given to check it against your input

The algorithm is identified automatically from the length.

Hashing only goes one way. A digest is a fixed-size fingerprint of your input, and there is no operation that turns it back into the original. Sites offering to “decrypt” a hash are looking the value up in a table of pre-computed common inputs — which is exactly why a plain hash is not a safe way to store a password.

Not for passwords. All five algorithms here are designed to be fast, which is the opposite of what password storage needs. Use a purpose-built, deliberately slow function — bcrypt, scrypt or Argon2 — with a per-user salt.

Your data never leaves your device

This tool runs entirely in your browser. Nothing you enter is uploaded, stored or logged by BeeTools.

How to use the hash generator

  1. Enter your text

    Type or paste anything. All five digests are computed as you go, with a short pause so a long paste is not re-hashed on every keystroke.

  2. Pick the digest you need

    SHA-256 is the right default for new work. Use MD5 or SHA-1 only when something you do not control requires them.

  3. Verify against a known hash

    Paste the expected digest into the comparison field. Its length identifies the algorithm, and a match or mismatch is shown beside that row.

  4. Copy the result

    Each digest has its own copy button.

Features

  • Five algorithms at once

    MD5, SHA-1, SHA-256, SHA-384 and SHA-512 computed together — no need to choose first.

  • Compare against a known digest

    Paste a hash you were given; the algorithm is identified by length and matched automatically.

  • Honest security guidance

    Each algorithm is labelled broken, weak or strong, with a note on what it is still fit for.

  • Native browser crypto

    The SHA family uses crypto.subtle.digest, so results match any standards-compliant implementation.

  • Unicode handled correctly

    Input is hashed as UTF-8 bytes — the same bytes a server would see for the same string.

  • Nothing is transmitted

    Hashing happens in this tab, so you can safely hash values you would not paste elsewhere.

About this tool

A hash function turns any input, of any length, into a fixed-size fingerprint. The same input always produces the same digest, a one-character change produces a completely different one, and there is no operation that runs the process backwards. That combination makes hashes useful for verifying that a file arrived intact, comparing two values without storing either, and building cache keys and content addresses.

This tool computes all five algorithms simultaneously rather than making you choose first, because the common case is having a digest from somewhere else and needing to work out which algorithm produced it. Paste a known hash into the comparison field and it is identified by length and checked against your input automatically.

The SHA family comes from crypto.subtle.digest, your browser's native implementation. MD5 does not: the Web Crypto API deliberately omits it because it is cryptographically broken, so it is implemented here directly and verified against the RFC 1321 test vectors. It remains genuinely useful for non-security work — checksums against legacy systems, ETags, cache keys, confirming a vendor's published digest — and that is the spirit in which it is offered, with the caveat stated next to it rather than buried.

One thing worth being unambiguous about: none of these algorithms is suitable for storing passwords. All five are designed to be fast, which is precisely what you do not want when an attacker is guessing. Password storage needs a deliberately slow, salted function — bcrypt, scrypt or Argon2.

  • Five algorithms at once. MD5, SHA-1, SHA-256, SHA-384 and SHA-512 computed together — no need to choose first.
  • Compare against a known digest. Paste a hash you were given; the algorithm is identified by length and matched automatically.
  • Honest security guidance. Each algorithm is labelled broken, weak or strong, with a note on what it is still fit for.
  • Native browser crypto. The SHA family uses crypto.subtle.digest, so results match any standards-compliant implementation.
  • Unicode handled correctly. Input is hashed as UTF-8 bytes — the same bytes a server would see for the same string.
  • Nothing is transmitted. Hashing happens in this tab, so you can safely hash values you would not paste elsewhere.

Frequently asked questions

Can a hash be reversed or decrypted?

No. Hashing is one-way by design: the digest is far smaller than most inputs, so the original information is genuinely gone. Sites offering to "decrypt" a hash are looking it up in a table of pre-computed digests for common inputs — which works for "password123" and never for a long random string. That is exactly why an unsalted hash is unsafe for password storage.

Which algorithm should I use?

SHA-256 unless something else dictates otherwise. It is widely supported, fast enough for any practical purpose, and has no known practical weaknesses. SHA-512 is a reasonable alternative and is often faster on 64-bit hardware. Choose SHA-384 only when a specification demands it, and choose MD5 or SHA-1 only for compatibility with a system you cannot change.

Why is MD5 still offered if it is broken?

Because "broken" means something specific: collisions can be produced deliberately, so MD5 cannot prove a file has not been tampered with by an adversary. It is still perfectly serviceable for detecting accidental corruption, generating cache keys, computing ETags, and checking a vendor’s published checksum. Removing it would not make anyone safer — it would just send people to a worse tool.

Can I use this to hash passwords?

No, and this is worth being blunt about. Every algorithm here is built for speed, which lets an attacker with a leaked database try billions of guesses per second. Password storage needs a function that is deliberately slow and salted per user: bcrypt, scrypt or Argon2. Hashing a password with SHA-256 is only marginally better than storing it in plain text.

Why does the same text give a different hash elsewhere?

Almost always a difference in the exact bytes being hashed rather than in the algorithm. A trailing newline, Windows CRLF line endings instead of Unix LF, or a different text encoding will all change the digest completely. This tool hashes exactly the characters you enter, encoded as UTF-8, with nothing appended.

Is my input sent to a server?

No. The SHA algorithms use your browser’s built-in Web Crypto API and MD5 is computed by JavaScript in this tab. Nothing is transmitted, which means you can safely hash values — configuration secrets, internal identifiers — that you would not want to paste into a remote service.

What is a hash collision?

Two different inputs producing the same digest. Because the output is fixed-size and the input is not, collisions must exist mathematically; what matters is whether anyone can find one on purpose. For MD5 that takes seconds, for SHA-1 it was demonstrated in 2017 at significant cost, and for the SHA-2 family no practical method is known.

Related tools

Tools that pair well with this one.