Hash generator — MD5, SHA-256 and can you decrypt them?

What a hash actually is, in plain words

A hash function takes an input of any size — a word, a paragraph, a whole book — and produces a fingerprint of a fixed size. MD5 always outputs 32 hexadecimal characters (128 bits); SHA-256 always outputs 64 characters (256 bits). Hash the single letter "a" or a million-line log file: the digest length is identical.

Three properties make that fingerprint useful. It is deterministic — the same input always produces the same digest, on any device, forever. It has the avalanche effect — change one letter and the entire digest changes beyond recognition. And it is one-way — you can go from text to hash in microseconds, but there is no calculation that goes back. Try it yourself in the hash generator: hash "hello", then "Hello", and compare the two results. They share nothing.

MD5 vs SHA-1 vs SHA-256 vs SHA-512 — which to use

All four algorithms do the same job at different security levels, and the choice matters:

• MD5 (128-bit) — fast but cryptographically broken: collisions can be manufactured. Fine for non-security jobs like deduplicating files or quick change detection; never for anything an attacker could target.
• SHA-1 (160-bit) — deprecated. Practical collisions were demonstrated in 2017, and browsers and Git have been moving away from it since. Use it only to check legacy values.
• SHA-256 (256-bit) — the sensible default. Part of the SHA-2 family, used by TLS certificates, software checksums and Bitcoin. When in doubt, pick this.
• SHA-512 (512-bit) — same family, longer digest, and often faster than SHA-256 on 64-bit hardware for large inputs. Choose it when you want extra margin.

How to generate an MD5 or SHA-256 hash online

Generating a digest takes seconds and works the same on desktop and phone. Open the hash generator, paste or type your text into the input box, and pick the algorithm — MD5, SHA-1, SHA-256 or SHA-512. The digest appears instantly as you type; tap copy to grab it.

What to expect: SHA-256 of "hello" is always 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 — a 64-character hex string, identical every time and on every device. That repeatability is the whole point: two parties can compare digests without ever exchanging the original text. Everything runs on your device via the browser's built-in crypto engine, so your text is never sent anywhere — safe even for sensitive strings.

Can you decrypt MD5 or SHA-256? The honest answer

No. "Decrypt" is the wrong word for hashes — there is no key and no reverse function. A hash discards information: infinitely many inputs map to the same fixed-length output, so even mathematically there is nothing to "unlock".

So what do the "MD5 decrypt" websites do? They run lookup tables: enormous databases of pre-computed hashes for billions of common strings — dictionary words, leaked passwords, "123456". If your hash is in the table, the site shows the original; if the input was long and random, it finds nothing. That is recognition, not decryption. The practical lesson: short, guessable text offers no protection once hashed, which is why a strong random password from a password generator matters — see the strong password guide and our password generator walkthrough for how sites should store passwords properly.

Verifying downloads and files with checksums

The most practical everyday use of hashing is integrity checking. Software publishers post the SHA-256 checksum of each release next to the download link. After downloading, you compute the digest of your copy and compare: if even a single bit changed in transit — corruption or tampering — the fingerprints won't match.

On your computer, built-in commands produce a file's digest (shasum -a 256 on macOS and Linux, certutil -hashfile on Windows); then paste the published value and your computed one into the hash generator page side by side, or compare them directly. For text — an API key you copied, a config block, a message — paste it straight into the tool and match digests with the other side. Matching digests mean byte-for-byte identical content; that certainty is what checksums are for.

Hashing vs encryption vs encoding — the difference

These three get mixed up constantly, and the difference is simple. Hashing is one-way with no key: you can verify but never recover the input. Encryption is two-way with a key: whoever holds the key can decrypt and read the original — that is what protects your messages and disks. Encoding is two-way with no key at all: it just represents data in another alphabet, and anyone can reverse it.

Base64 is the classic example of encoding — it is not encryption and hides nothing. Decode any Base64 string instantly with the Base64 encoder, and read the Base64 and URL encoding guide for where each is used. One more cousin worth knowing: when you need a random unique identifier rather than a fingerprint of existing data, that is a job for the UUID generator, not a hash.

Frequently asked questions