MD5 / SHA Hash Calculator

Encoding & Crypto

Everything runs locally in your browser — nothing is uploaded

Algorithm

Output encoding

Uppercase hex (Base64 ignores this)

Input

Output

Press Ctrl/⌘ + Enter to run · Press Esc to clear

Compute an MD5, SHA-1, SHA-256 or SHA-512 digest of any text, as hexadecimal or Base64. Non-ASCII text is hashed as UTF-8 bytes, so digests line up with openssl and sha256sum digit for digit — hash the characters instead and mixed-language text produces a digest nobody else can reproduce. MD5 is a built-in implementation here, because the browser Web Crypto API no longer offers it. One warning worth repeating: MD5 and SHA-1 are unfit for passwords and signatures, and belong in checksums and in reproducing digests you were handed.

Features

Four algorithms: MD5, SHA-1, SHA-256 and SHA-512
Output as hexadecimal (upper or lower case) or Base64
Non-ASCII text hashed as UTF-8 bytes, matching openssl and sha256sum
MD5 implemented inside the tool, since Web Crypto has dropped it
Multi-megabyte input is handled without freezing the page
The digest is computed in local memory; your content never leaves the browser

How to use

Paste your text into the input box
Choose the algorithm and output encoding (tick the box for uppercase hex)
Press Ctrl/⌘ + Enter, or click Run
Click Copy to take the digest

FAQ

Why do I get "this environment does not provide Web Crypto"?: The SHA family runs through the browser-native crypto.subtle API, and that API only exists in a secure context: the page must be opened over https:// or from localhost / 127.0.0.1. Over http:// or a LAN IP it is simply unavailable — a browser policy, not a limit of this tool. MD5 still works there, because that implementation does not depend on it.
Is MD5 still usable?: For checksums, yes. For anything security-related, no. Both MD5 and SHA-1 have practical collision attacks — two different inputs producing the same digest — so they must not be used for password storage, signatures or tamper detection. Use bcrypt, scrypt or Argon2 for passwords.
How is a hash different from encryption?: A hash is one-way: content produces a digest, but the digest cannot be turned back into the content, and there is nothing to decrypt. Encryption is reversible and needs a key. That is why online "MD5 decrypt" services are really rainbow tables or brute force, and only ever return an input that happens to match.
Why does my digest differ from the one I was given?: Almost always an encoding difference. The same non-ASCII text is 6 bytes in UTF-8 and 4 in GBK, so the digests differ. This tool always uses UTF-8, which is the convention across today’s web pages and APIs.
Is there a length limit?: Input is capped at roughly 5 MB, past which you get a clear message instead of a frozen tab. Digest length is fixed regardless of input: 128 bits for MD5, 160 for SHA-1, 256 for SHA-256 and 512 for SHA-512.

Related tools

HMAC

Encoding & Crypto

Sign a message with a secret key using HMAC and get a result matching Node, Java and Python. The key never leaves your browser — nothing is uploaded.

Base64

Encoding & Crypto

Convert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.

Password Generator

Generators

Generate strong random passwords with a live entropy readout, so strength becomes a number you can compare. Passwords stay in memory, never uploaded.

URL Encode

Encoding & Crypto

Escape text into %XX form and back again, treating a whole URL and a single parameter value as different jobs. Runs entirely in your browser.

HTML Entities

Encoding & Crypto

Turn < > & and quotes into HTML entities and decode them back in a single pass, so &lt; becomes <, not an angle bracket. Runs in your browser.

JWT Decoder

Encoding & Crypto

Split a JWT into header, payload and signature, and read iat, nbf and exp as dates. The signature is not verified — decoding only, all in your browser.

← Back to all tools