Hash generator online
What a hash generator does
A hash function turns any input, a word, a file or a whole database dump, into a fixed-length fingerprint. The same input always produces the same hash, and changing even one character produces a completely different one. This hash generator online lets you create those fingerprints for many values at once instead of one at a time.
Every hash here is calculated with PHP's built-in hash(), hash_hmac() and password_hash() functions. They follow the published standards (RFC 1321 for MD5, FIPS 180-4 for SHA-2, FIPS 202 for SHA-3), so the result matches what Linux sha256sum, Python hashlib, Node crypto or any database function would give you for the same bytes.
Algorithms at a glance
| Algorithm | Length | Use it for |
|---|
| MD5 | 32 hex | Checksums, cache keys, legacy systems. Not secure against deliberate collisions. |
| SHA-1 | 40 hex | Git object IDs and older APIs. Also broken for collisions. |
| SHA-256 | 64 hex | The modern default for checksums, signatures, API signing and blockchains. |
| SHA-512 | 128 hex | Extra margin, often faster than SHA-256 on 64-bit servers. |
| SHA-3, RIPEMD-160, Whirlpool | varies | Specific protocols and standards that require them. |
| CRC32, Adler-32, xxHash, XXH3, MurmurHash3, FNV-1a | 8 to 32 hex | Fast non-cryptographic hashing for deduplication, hash tables and sharding. |
| NTLM | 32 hex | The Windows NT hash (MD4 of the UTF-16LE password), for testing Active Directory setups. |
Password hash generator
bcrypt, Argon2 and WordPress password hashes
Never store passwords with MD5 or SHA-256, even with a salt. They are designed to be fast, which lets an attacker test billions of guesses per second. Password hashes are deliberately slow and include a random salt. Use the Password hash tab as a bcrypt generator or Argon2 generator:
- Argon2id is the current recommendation from OWASP and the winner of the Password Hashing Competition.
- bcrypt (
$2y$) is supported everywhere. Raise the cost by 1 to double the work. A cost of 12 is a good default in 2026. bcrypt only reads the first 72 bytes of a password.
- WordPress password hash: WordPress 6.8 and later store passwords as
$wp$2y$..., which is bcrypt over an HMAC-SHA384 pre-hash. Generate one here to reset a password directly in the wp_users table, or verify an existing hash.
Paste an existing hash into Verify to check whether a password matches. Supported formats are bcrypt, Argon2, WordPress $wp$, older WordPress and phpBB $P$ phpass hashes, and plain MD5. Because each hash has a new random salt, generating twice gives two different strings that both verify correctly.
Advertisement
MD5 and SHA256 generator
Bulk MD5, SHA-256 and HMAC hashing
Tick Hash each line separately to use this as a bulk MD5 hash generator or SHA256 generator. Paste a column of emails, IDs or URLs and get one row per value with every algorithm you selected, ready to download as CSV. A common use is preparing hashed email lists for ad platforms, which expect lowercase, trimmed addresses hashed with SHA-256.
Add a secret in HMAC secret key to produce HMAC-SHA256 or any other HMAC. That is how webhooks from Stripe, GitHub, Shopify and many APIs are signed: the receiver recomputes the HMAC of the request body with the shared secret and compares it with the signature header. Choose Base64 output when the API expects Base64 rather than hex.
Use Compare with expected hash to confirm a match without reading 64 characters by eye.
File hash and SRI
File checksums and SRI integrity hashes
Download pages often publish a SHA-256 or MD5 checksum next to an installer or ISO. Upload the file in the File hash tab, paste the published value into Compare, and you will know immediately whether the download is complete and untampered.
Subresource Integrity (SRI) protects your site when you load JavaScript or CSS from a CDN. The browser hashes the file it receives and refuses to run it if the hash differs from the integrity attribute. The SRI hash tab fetches the file from its URL (or takes an upload or pasted code), calculates the sha384-... value in Base64, and gives you the complete <script> or <link> tag with crossorigin="anonymous". Pin the exact file version in the URL, because any update to the file changes the hash.
Related tools: encode the raw output with the Base64 encoder, or create unique IDs with the UUID generator.
FAQ
Hash Generator: frequently asked questions
What is a hash generator?
A hash generator calculates a fixed-length fingerprint of text or a file using an algorithm such as MD5 or SHA-256. The same input always gives the same hash, so hashes are used to verify data and compare values without storing the original.
How do I generate an MD5 or SHA-256 hash?
Paste your text, tick MD5 and SHA-256 under Algorithms and click Generate hash. Tick Hash each line separately to get one hash per line for a whole list.
Can a hash be reversed or decrypted?
No. Hashing is one-way. Short or common inputs can sometimes be found by guessing and comparing against lookup tables, which is why passwords must use a slow, salted algorithm like bcrypt or Argon2.
What is the best password hashing algorithm?
Argon2id is the current recommendation. bcrypt with a cost of 12 or higher is also safe and is supported by almost every language and framework.
How do I create a WordPress password hash?
Open the Password hash tab, choose WordPress 6.8+, enter the password and click Generate hash. Paste the $wp$ result into the user_pass column of the wp_users table. Older $P$ hashes can be verified too.
How do I check a file checksum?
Open the File hash tab, upload the file, tick the algorithm the publisher used (usually SHA-256), and paste their checksum into Compare with expected hash.
What is an SRI hash?
An SRI hash is a Base64 SHA-384 (or SHA-256/512) digest placed in the integrity attribute of a script or link tag. The browser blocks the file if it has been changed.
Is my input stored?
No. Text, files and passwords are processed in memory for one request and never saved or logged. Still, avoid pasting live production passwords into any website.