Free tool Hash generator: MD5, SHA-1 and SHA-256
Paste text and get its MD5, SHA-1 and SHA-256 hashes side by side. Normalize emails before hashing so they match across systems, or hash a list one line at a time. Everything is computed in your browser.
- MD5, SHA-1, SHA-256
- Hash a list line by line
- Runs locally
Hash any text
Hashes update as you type. The text is encoded as UTF-8, and every character counts, including spaces and a trailing line break.
A password, an email, an API string, a list of IDs. Nothing is uploaded, and this box is never put into a link.
6b56db1f84a3997b902509d3fbf0a306Fine for checksums and cache keys. Not safe for passwords or signatures.
46864313fa6d54ca75d20f478c80edfa75d92a16Still seen in Git and older systems. Collisions have been demonstrated, so avoid it for security.
f7d54c22dda5b1780276601cd005909b70543fc4a6ba72d735b4cb9bbb611f01The default choice for matching identifiers and verifying data.
Hash, two spaces, then the line, like the output of sha256sum. Blank lines are skipped.
Version v1.0Updated Update history
Four outputs, one input
All three algorithms read the same bytes. They differ in length and in how much you can trust them against deliberate attacks.
MD5
A 32-character fingerprint. Good enough to spot an accidental change or to build a cache key, but researchers can create two inputs with the same MD5, so it must not protect anything.
SHA-1
A 40-character fingerprint. Stronger than MD5 but also broken for collision resistance. You will mostly meet it in Git commit IDs and legacy integrations.
SHA-256
A 64-character fingerprint from the SHA-2 family. Use it when two systems need to match the same email or user ID without exchanging the raw value.
SHA-256 per line
With "Hash each line" on, every non-empty line gets its own SHA-256, so you can hash a column of emails in one go. The three boxes above still hash the whole text.
A hash is deterministic: the same bytes always give the same result. Change one letter, add a space or a line break, and the whole hash changes. That is why normalizing first matters when you want two systems to match.
Three common jobs
Most people need a hash for one of these reasons.
-
1
Check a value
Paste a string and compare the hash with the one an API, a database or a teammate gave you. Watch for stray spaces and line breaks.
-
2
Prepare an identifier
Turn on "Normalize first" for emails, so
Anna@Example.comandanna@example.comgive the same SHA-256. -
3
Hash a list
Paste one value per line and turn on "Hash each line". Copy the result into a spreadsheet or an upload file.
MD5, SHA-1 and SHA-256 compared
A hash function maps input of any length to a fixed-length output. It cannot be run backwards, and it has no key: anyone with the same input gets the same hash. That makes hashing different from encryption, which is designed to be reversed with a key.
- Hashing is one-way; encryption is two-way with a key
- Short or predictable inputs (phone numbers, common emails) can be guessed by hashing candidates, so a plain hash is not anonymous
- For passwords, use a salted, deliberately slow hash such as bcrypt, scrypt or Argon2, never plain MD5 or SHA-256
- Text is hashed as UTF-8; a system using another encoding will get a different hash for non-ASCII text
| Algorithm | Output | Hex length | Collisions | Use it for |
|---|---|---|---|---|
| MD5 | 128 bits | 32 | Practical attacks | Checksums, cache keys, legacy APIs |
| SHA-1 | 160 bits | 40 | Demonstrated | Git IDs, legacy systems |
| SHA-256 | 256 bits | 64 | None known | Matching IDs, data integrity, signatures |
One email, four hashes
The same address typed four ways. Without normalizing, a capital letter or a stray space gives a completely different hash, so the records would never match.
| Input | Normalize | MD5 | SHA-256 (first 16 of 64) |
|---|---|---|---|
anna@example.com | Off | 6b56db1f84a3997b902509d3fbf0a306 | f7d54c22dda5b178… |
Anna@Example.com | Off | 3f54a4758be5eeeeb5ac0cb24e8a6022 | 1fdc88a445bfd76d… |
anna@example.com (spaces) | Off | 187bc460e5394be00b3975ad3a4e0277 | ac12539a3aad8c0b… |
Anna@Example.com | On | 6b56db1f84a3997b902509d3fbf0a306 | f7d54c22dda5b178… |
With normalization on, the last row matches the first exactly. Run the same normalization on both sides of any match, for example before uploading hashed emails to an ad platform.
Where hashes go wrong
The algorithm is never the problem. The input and the expectations are.
Hidden whitespace
A trailing line break from copying, or echo without -n in a shell, changes every hash. Compare the exact bytes.
Calling it encryption
There is no key and no way back. Sites that "decrypt" MD5 only look up hashes of strings they have already seen.
Storing passwords with MD5 or SHA
Fast hashes can be guessed at enormous speed once leaked. Passwords need a salted slow hash such as bcrypt or Argon2.
Treating a hash as anonymous
A hashed email can be recomputed by anyone who has the address. Under the GDPR it is pseudonymous personal data.
Identify people without spreading their details
TapCub hashes identifiers on the server and lets you recognise a person by an ID you control, so raw contact details do not need to travel with every event.
Identify with your own ID
Call identify with your user ID at login and TapCub merges the devices into one profile, including visits before login. A hashed ID works like any other.
Learn moreHashed visitor IDs
Visitor IDs are a keyed hash (HMAC-SHA256) of a secret site salt, the IP address and the browser. The IP address itself is not stored.
Learn moreEvents without raw contact data
Event properties are stored as you send them, so send a hash rather than an email or phone number.
Learn moreHash generator questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
What does a hash generator do?
It runs your text through a hash function and shows the fixed-length result. This one gives MD5, SHA-1 and SHA-256 at once, computed in your browser from the UTF-8 bytes of the text.
Can an MD5 or SHA-256 hash be decrypted?
No. A hash keeps no copy of the input. "Decrypt" sites keep huge tables of hashes for known strings and look yours up, which works for common passwords and short values but not for unpredictable text.
Is hashing the same as encryption?
No. Encryption is designed to be reversed by someone with the key. Hashing has no key and no reverse. Use encryption for data you need to read back, and hashing for data you only need to compare or match.
Why does my hash differ from another tool or my code?
Almost always the input differs: a trailing newline, spaces, different letter case, or a different text encoding for non-ASCII characters. Hex case does not matter: A3F1 and a3f1 are the same hash.
MD5 or SHA-256: which should I use?
SHA-256 for anything new: it is longer and has no known collisions. Use MD5 only when a system you integrate with asks for it, as many older API signatures and checksums do.
Should I use MD5 or SHA-256 to store passwords?
Neither on its own. Both are fast, so stolen hashes can be guessed at enormous speed. Use a password hashing function with a per-user salt, such as bcrypt, scrypt or Argon2.
Is a hashed email still personal data?
Usually yes. Anyone who has the original address can recompute the hash and match it, so under the GDPR it is pseudonymised, not anonymised. Apply the same care over access and retention. See GDPR.
Can I hash a file with this tool?
No, it hashes text only. For a file, use the command line: shasum -a 256 file on macOS, sha256sum file on Linux, or certutil -hashfile file SHA256 on Windows.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Recognise customers by an ID you control
Send your own user ID, hashed if you prefer, and TapCub ties every device and visit to the same profile.