Password Hash Generator

What this tool does

Password Hash Generator computes a cryptographic digest of the text you enter. You choose one of eighteen algorithms, the server runs PHP's hash function on the exact string and returns the digest in lowercase hexadecimal. The page also shows the digest length and the algorithm's bit size.

Despite the name, it is a general text-digest tool, not a password storage system. It does not add a salt, choose a work factor or produce a bcrypt or Argon2 hash. The next sections explain why that distinction matters.

Available algorithms

The list includes MD2, MD4 and MD5 at 128 bits; RIPEMD-128, RIPEMD-160, RIPEMD-256 and RIPEMD-320; SHA-1 at 160 bits; SHA-224, SHA-256, SHA-384 and SHA-512; the truncated SHA-512/224 and SHA-512/256 variants; and SHA3-224, SHA3-256, SHA3-384 and SHA3-512.

MD2, MD4, MD5 and SHA-1 are legacy algorithms. MD5 and SHA-1 are broken for collision resistance, meaning different inputs can be crafted to produce the same digest. They are still seen in old checksum lists and cache keys, but they should not be used for new security work.

How to generate a hash

1. Paste or type the text into the input box. The limit is 20,000 characters.
2. Choose an algorithm from the panel on the right.
3. Press the generate button and wait for the server response.
4. Read the digest, length and bit size, then copy the value.

The input is sent to the server as plain text. There is no salt field, no iteration count, no key and no file upload. The same text with the same algorithm always produces the same digest, which is the point of a hash and also why it is unsuitable for passwords on its own.

Reading the output

A hex digest uses two characters per byte. MD5 is 16 bytes and 32 hex characters; SHA-256 is 32 bytes and 64 characters; SHA-512 is 64 bytes and 128 characters. The page reports both the character length and the bit size so you can confirm you copied the whole value.

Hashing is one-way in practice: you cannot recover the input from the digest. A short or predictable input can still be guessed by trying candidates and comparing hashes, which is why unsalted password hashes are vulnerable to lookup tables and brute force.

Do not use this for password storage

General-purpose hashes are designed to be fast. Fast is exactly what an attacker wants when testing billions of password guesses. Storing raw MD5, SHA-1 or even SHA-256 of a password is not acceptable practice, and MD5 or SHA-1 is worse because collisions are practical.

Use your framework's password API instead: PHP's password_hash with PASSWORD_ARGON2ID or PASSWORD_BCRYPT, a unique salt generated for each user, a calibrated cost, and a server-side pepper if your design supports it. Add rate limiting, multi-factor authentication and a breach-response plan. Never store the plaintext password or send it to a random online tool.

Integrity checks and other uses

Digests are useful for comparing files or payloads, generating cache keys, detecting duplicate content and building content-addressed storage. For a file checksum, use SHA-256 or stronger and compare the full digest, not a short prefix. For message authentication, use HMAC with a secret key; a plain hash does not prove who sent the data.

This page does not implement HMAC, digital signatures or key derivation. If you need those, use a dedicated library or command-line tool rather than composing them from a hash function.

Hash, encryption and encoding are different

Hashing is one-way: the digest is not meant to be turned back into the input. Encryption is reversible with the right key, and encoding such as Base64 is reversible without a key. Base64 is not encryption and a hash is not encryption; mixing those terms leads to bad storage and transport decisions.

If you need to recover the original text later, use encryption with proper key management, not a hash. If you only need to compare two values, a hash is appropriate.

Choosing a digest size

128-bit digests are legacy, 160-bit SHA-1 is legacy, and 256 bits is a sensible default for checksums and cache keys. SHA-512 costs little on modern hardware and is a conservative choice when compatibility allows it. SHA-3 uses a different internal construction and is a reasonable alternative, not a simple upgrade path.

Longer is not automatically better for passwords. A fast 512-bit hash is still fast to brute-force; password security comes from a slow, salted, memory-hard function, not from digest length alone.

A note on collisions

A collision means two different inputs produce the same digest. MD5 and SHA-1 collisions are practical to construct, which is why they are unsuitable for signatures or integrity checks against deliberate tampering. Accidental collisions in SHA-256 are not a practical concern for normal files and text.

When you publish a checksum, state the algorithm next to it, for example SHA-256. A bare hex string is ambiguous because different algorithms produce different lengths, and even the same length can come from different functions. For reproducible builds, record the tool and version as well. If a download page offers only MD5, treat it as a quick corruption check rather than proof that the file is authentic; prefer a signed release when one is available.

Privacy and limits

The page has no local-only mode; every digest is computed by the server. For a production secret, use your own server-side hashing library or a local command instead.

The text you enter is transmitted to the server to compute the digest. Do not paste real passwords, private keys, API tokens or personal data. For sensitive values, run a local command such as sha256sum or openssl dgst on your own machine.

The tool does not hash files, verify a hash against an expected value, produce a salted password hash or download a report. It returns one digest at a time and keeps no account history.

Frequently Asked Questions