What is the difference between MD5 and SHA-256?

MD5 produces a 128-bit (32-character hex) digest and was once widely used for integrity checking, but it is now considered cryptographically broken for security-sensitive purposes because collisions can be generated in seconds with modern hardware. SHA-256 produces a 256-bit (64-character hex) digest and is part of the SHA-2 family standardised by NIST. SHA-256 is resistant to collision attacks and is safe for digital signatures, certificate fingerprints, password hashing (combined with a salt), and data integrity verification. Use MD5 only for non-security purposes such as quick file-change detection in trusted environments.

Can I reverse a hash back to the original text?

No. Cryptographic hash functions are one-way functions: given a hash output, there is no efficient algorithm to recover the original input. This is the core property that makes them useful for storing passwords (you store the hash, not the plaintext). Short or common inputs can sometimes be looked up in pre-computed rainbow tables, which is why passwords must be hashed with a unique random salt before hashing. This tool runs all computation in your browser and never sends your input to any server.

When should I use SHA-512 instead of SHA-256?

SHA-512 produces a 512-bit (128-character hex) digest, double the output length of SHA-256. On 64-bit processors SHA-512 can actually be faster than SHA-256 because it processes data in 64-bit words rather than 32-bit words. SHA-512 is preferred where maximum collision resistance is required, such as high-security digital signatures, long-lived archival checksums, or systems that need to meet standards requiring 256-bit security strength. For most everyday integrity checks and web application use, SHA-256 offers more than adequate security.

Hash Generator (MD5, SHA-1, SHA-256, SHA-512)

This hash generator turns any piece of text into its cryptographic fingerprint, the fixed-length digest used to verify file integrity, spot duplicate content, and understand how algorithms like MD5 and SHA work under the hood. Type or paste any text into the input box, tick which algorithms you want from MD5, SHA-1, SHA-256 and SHA-512, and choose your output format: lowercase hex, uppercase hex, or Base64. The calculator returns a hash for each algorithm you select, along with the input length in bytes and the character count, so you can confirm exactly what was hashed. Because a single changed character produces a completely different digest, the tool is useful for checking whether two files or strings are identical, verifying a download against a published checksum, or simply seeing how each algorithm's output length differs, from MD5's 32-character hex string to SHA-512's 128 characters. A worked example using the default text "Hello, World!" shows the expected result for each algorithm so you can confirm the tool is working correctly before using your own data. All hashing runs directly in your browser using the Web Crypto API and a built-in MD5 implementation, so your text is never uploaded or stored anywhere. Remember that MD5 and SHA-1 are no longer considered secure for protecting sensitive data such as passwords; use SHA-256 or SHA-512 for anything security-related.

Calculate.co.nz is proud to be partnered with realtor.co.nz, a trusted resource for navigating the New Zealand property market. Their Helpful Articles section offers clear, well-structured insights across buying, selling, and building, making complex real estate topics more accessible. With a focus on up-to-date guidance and practical knowledge, they empower Kiwis to move forward with clarity and confidence in a constantly evolving property landscape.

Standard algorithms MD5 (RFC 1321) and SHA-2 family (NIST FIPS 180-4). Results are deterministic and reproducible.

1. Input Text

Text to hash (any UTF-8 string)

Algorithms to compute

MD5 (128-bit) SHA-1 (160-bit) SHA-256 (256-bit) SHA-512 (512-bit)

Output format

Hash Results

MD5 (128-bit / 32 hex chars)

SHA-1 (160-bit / 40 hex chars)

SHA-256 (256-bit / 64 hex chars)

SHA-512 (512-bit / 128 hex chars)

Input length: 0 bytes (UTF-8) Input characters: 0

Worked Example: Input "Hello, World!"

Algorithm	Hash (hexadecimal)
MD5	65a8e27d8879283831b664bd8b7f0ad4
SHA-1	0a0a9f2a6772942557ab5355d76af442f8f65e01
SHA-256	dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f
SHA-512	374d794a95cdcfd8b35993185fef9ba368f160d8daf432d08ba9f1ed1e5abe6cc69291e0fa2fe0006a52570ef18c19def4e617c33ce52ef0a6e5fbe318cb0387

These values match the calculator defaults. The default input field is pre-loaded with "Hello, World!" so you can verify the output immediately.

Privacy note: This tool runs entirely in your browser. Your input text is never transmitted to any server. You can verify this by disconnecting from the internet and the tool will continue to work.

What Is a Cryptographic Hash?

A cryptographic hash function takes an input of any length and produces a fixed-length output called a digest or hash. The same input always produces the same output (deterministic), but a tiny change to the input produces a completely different hash (the avalanche effect). For example, hashing "hello" and "Hello" produces entirely different SHA-256 digests. Hash functions are one-way: you cannot reverse a hash to recover the original input.

Common Algorithms

Algorithm	Output size	Hex length	Security status	Typical use
MD5	128 bits	32 chars	Broken (collision attacks)	Non-security checksums, legacy systems
SHA-1	160 bits	40 chars	Deprecated (collision found 2017)	Legacy certificates, git object IDs
SHA-256	256 bits	64 chars	Secure	TLS, code signing, password hashing, blockchain
SHA-512	512 bits	128 chars	Secure	High-security signatures, archival checksums

How the Calculation Works

Your input text is encoded to bytes using UTF-8. Each algorithm then processes the bytes through its specific compression function:

MD5 divides input into 512-bit blocks, applies four rounds of 16 operations each using bitwise logic and modular addition, producing a 128-bit final state. This tool uses a pure-JavaScript RFC 1321 implementation.
SHA-1 uses 512-bit blocks and 80 rounds of compression to produce a 160-bit digest. This tool uses the browser's native Web Crypto API for SHA-1, SHA-256, and SHA-512, which is hardware-accelerated on most devices.
SHA-256 processes 512-bit blocks through 64 rounds using 8 working variables and 64 constant words derived from the cube roots of the first 64 primes.
SHA-512 is similar to SHA-256 but uses 1024-bit blocks and 80 rounds with 64-bit words, giving a 512-bit digest.

Hex vs Base64 Output

The raw hash is a sequence of bytes. There are two common ways to represent those bytes as printable text:

Hexadecimal encodes each byte as two characters (0-9, a-f). A SHA-256 hash is 32 bytes, so the hex representation is 64 characters. Hex is the most common representation in security tools, programming languages, and documentation.
Base64 encodes every 3 bytes as 4 ASCII characters, making the output roughly 33% shorter than hex. Base64 is common in email, HTTP headers, and some APIs.

Use Cases

File integrity: publish the SHA-256 hash of a download alongside it, so users can verify the file has not been tampered with.
Password storage: store the hash of a password (with a unique per-user salt) rather than the plaintext. Use a purpose-built password hashing function such as bcrypt, Argon2, or scrypt in production systems.
Digital signatures: sign the hash of a document rather than the document itself.
Data deduplication: identify duplicate files by comparing their hashes rather than their content byte by byte.
Commit identifiers: Git uses SHA-1 (and is migrating to SHA-256) to uniquely identify commits and objects.

Related Calculators

Essential Calculators: all computer and digital tools.
Base64 Encoder / Decoder: encode and decode Base64 strings.
IP Subnet Calculator (CIDR): subnet masks and host ranges.
Bandwidth Calculator: data transfer time and throughput.
CSS Unit Converter (px, em, rem): convert between CSS length units.

Sources and method: MD5 implementation based on RFC 1321 (Rivest, 1992). SHA-1, SHA-256, and SHA-512 computed via the Web Crypto API (W3C specification, using browser-native implementations conforming to NIST FIPS 180-4). Output encoding follows standard hexadecimal and Base64 conventions.

This tool is provided for educational and development purposes. Do not use MD5 or SHA-1 for new security-sensitive applications. For password hashing in production systems, use a purpose-built algorithm such as bcrypt, Argon2id, or scrypt with appropriate work factors. All computation runs in your browser and no data is transmitted.