Tool StudioMD5, SHA-1, SHA-256, Bcrypt & more, from text or a file
Enter text or choose a file
Type/paste text, or upload a file to hash instead. Add an optional salt if you need one.
View all hashes
MD5, SHA-1, SHA-256, SHA-384, and SHA-512 compute simultaneously. Paste an expected hash to check which one matches.
Need a password hash instead?
Use the Bcrypt section below to generate or verify a password hash — it works differently on purpose.
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or an uploaded file — all five compute at once, entirely in your browser. Nothing is uploaded, and none of it leaves your device.
Checking a download against a published hash? Paste it into "Compare against a hash" and whichever algorithm matches gets flagged for you, so you don't have to eyeball two long hex strings. Need a salted hash? There's an optional Salt field that gets appended to your input before hashing.
Need to hash a password instead of a file or a general string? Use the Bcrypt section below — it's a different kind of hash on purpose, built specifically for passwords: deliberately slow, and it produces a different result every time even for the same input, because it generates its own random salt internally (the Salt field above doesn't apply to it). Set a cost factor, generate a hash, or verify a password against one you already have.
This tool computes hashes — it doesn't check a file's hash against malware or virus databases. If you're looking to scan a suspicious file, a dedicated service like VirusTotal is the right tool for that job.
No — hashing happens entirely in your browser using the Web Crypto API (and a client-side implementation for MD5 and Bcrypt, which the browser doesn't support natively). Files never leave your device.
Paste the expected hash into "Compare against a hash" — whichever algorithm's output matches it gets flagged automatically, so you don't have to compare long hex strings by eye.
It's appended to your input before hashing with MD5/SHA, which changes the output — useful if you need a salted checksum. It doesn't apply to Bcrypt, which generates its own random salt automatically.
No — this tool only computes cryptographic hashes. Checking a hash against malware databases needs a dedicated service like VirusTotal; that's a different job from what this tool does.
No — hashing is intentionally one-way. There's no way to reverse a hash back into its original input; that's what makes it useful for verification instead of storage.
MD5 is broken for anything adversarial — passwords, digital signatures, tamper-proofing — but it's still genuinely fine for non-adversarial uses like checking a download for accidental corruption or comparing two files, which is why it's included alongside the stronger SHA-2 family.
No — MD5 always produces a 128-bit hash, shown as 32 hexadecimal characters. It has nothing to do with 32-bit vs. 64-bit systems; the output length is fixed by the algorithm regardless of what device or architecture generated it.
Bcrypt is built specifically for hashing passwords, not general data. It's deliberately slow (to make brute-forcing expensive) and generates a random salt internally, so hashing the same password twice gives two different results — that's normal, not a bug. Because of that, you verify a password against a Bcrypt hash instead of comparing two hashes directly, which is what the Verify option does.
Yes — SHA-256 always produces a 256-bit (32-byte, 64 hex character) output, whether you hash one character or an entire file. That fixed length is what makes hashes useful as short fingerprints for arbitrarily large data.
Generate random UUID v4 identifiers instantly, one or in bulk (up to 100 at once). Copy individually or all at once. Perfect for database keys, API testing, and unique identifiers in code. 100% client-side using crypto.randomUUID().
Generate strong, random passwords instantly. Adjustable length and character sets (uppercase, lowercase, numbers, symbols), live strength indicator, one-click copy. All generation happens in your browser using the Web Crypto API — passwords are never sent anywhere.
Comprehensive token tool to decode, verify, and generate JWT (JSON Web Tokens) and PASETO (Platform-Agnostic SEcurity TOkens) instantly. View header, payload, and signature sections with syntax-highlighted JSON. Generate new tokens with custom payloads. Perfect for developers debugging authentication tokens, API tokens, and bearer tokens. Features instant real-time decoding as you type, support for both JWT and PASETO token formats, token generation with custom algorithms (HS256, HS384, HS512), three-part visualization showing header/version, payload, and signature/footer separately, color-coded JSON syntax highlighting for easy reading, one-click copy to clipboard for each section, and complete client-side processing for maximum security. All token processing happens entirely in your browser - tokens are never transmitted to any server, ensuring complete privacy and security. Supports all standard JWT formats and PASETO v2/v4. Ideal for debugging authentication flows, inspecting API tokens, generating test tokens, understanding token structure, validating token claims, and learning about modern authentication. No installation or registration required.
Format, validate, and beautify JSON data instantly. Minify JSON, fix formatting errors, and validate JSON syntax online. Perfect for developers working with APIs and configuration files.
—————Password-specific hashing — deliberately slow, and produces a different result every time even for the same input, because it generates and embeds its own random salt automatically. The Salt field above is ignored here. Doesn't apply to files.