Tool guide
About MD5 & SHA Hash Generator
A hash generator turns text into a fixed-length digest such as MD5, SHA-1, SHA-256, SHA-384, or SHA-512.
This tool computes the digest in your browser, supports uppercase output, and is useful for checksums, quick comparisons, signatures, and debugging examples.
How to use the MD5 & SHA Hash Generator
- Paste the text you want to hash into the input area.
- Choose MD5, SHA-1, SHA-256, SHA-384, or SHA-512 depending on the system you need to match.
- Turn on uppercase only if the expected checksum format uses uppercase hexadecimal.
- Copy the output and compare it with the expected digest from your API, build process, or documentation.
When you would use it
- Verify that a short text payload matches a documented MD5 or SHA checksum.
- Create sample digests for API signing examples, tests, or documentation.
- Compare two pieces of text by hashing them with the same algorithm.
- Debug case-sensitive checksum mismatches where uppercase and lowercase output are both seen in the wild.
Hash algorithms and common mistakes
A hash is one-way: you can compute a digest from input, but you cannot decrypt a digest back into the original text. Algorithm choice matters because each system expects a specific digest length and format.
- MD5: fast and widely used for legacy checksums, but not suitable for security-sensitive collision resistance.
- SHA-1: also legacy for security use; keep it only when an old system requires it.
- SHA-256: the common modern default for examples, integrity checks, and many signing workflows.
- Input bytes matter: whitespace, newlines, encoding, and invisible characters change the hash.
MD5 & SHA Hash Generator FAQ
- Is a hash the same as encryption?
- No. Encryption is reversible with a key; a hash is one-way and is used for comparison, integrity checks, or signatures.
- Can I get the original text back from an MD5 hash?
- No. A hash digest does not contain enough information to restore the original input.
- Why does my hash not match another tool?
- Check for extra spaces, line endings, character encoding, uppercase output, and whether both tools used the same algorithm.
- Should I use MD5 or SHA-256?
- Use the algorithm required by your target system. For new non-legacy examples, SHA-256 is usually a safer default than MD5.
- Is my input uploaded to calculate the hash?
- No. Hash calculation runs locally in the browser and the input is not uploaded to wetool.site.
Hash generator vs password hashing
This tool computes raw MD5 and SHA digests. It is not a password storage tool: real password storage needs slow, salted algorithms such as bcrypt, scrypt, or Argon2 on a trusted backend.
Normalize input before comparing hashes
One extra newline, space, or encoding change makes MD5/SHA output completely different. When hashes do not match, verify the bytes first.
- Check trailing newlines when copying text; Linux echo appends a newline unless you use echo -n.
- Confirm whether the input is UTF-8, UTF-16, or raw binary; hashing text is not the same as hashing file bytes.
- For downloaded files, hash the original file content, not the filename, URL, or browser preview text.
Hash, HMAC, and password storage boundaries
A hash can verify integrity, but it does not prove who created the message and it is not enough for password storage.
- Plain SHA-256 only shows whether input changed; an attacker who can replace both content and hash can still bypass it.
- Use HMAC-SHA256 for keyed integrity instead of concatenating a secret and hashing the result.
- Store passwords with slow salted algorithms such as Argon2, bcrypt, or scrypt, not raw MD5/SHA digests.