Hash Generator Developer Tool

What a cryptographic hash function does

A cryptographic hash function takes an input of any size — a word, a JSON document, a multi-gigabyte file — and produces a fixed-length output (the digest) that acts as that input's fingerprint. The same input always produces the same digest, changing even a single byte of the input produces a completely different digest, and, for a good algorithm, there's no practical way to work backwards from the digest to the original input or to find two different inputs that produce the same digest (a collision). Those three properties — determinism, the avalanche effect, and collision resistance — are what make hashes useful for verifying that data hasn't changed, without needing to store or compare the data itself.

// Hashing a string with PHP's built-in hash() function
$digest = hash('sha256', 'hello world');
// 'b94d27b9934d3e08a52e52d7da7dacefbd0c0aac274ac68af8ad0aa06d7cb6f'

// Hashing a file
$digest = hash_file('sha256', storage_path('app/upload.zip'));

MD5 and SHA-1 vs. SHA-256/384/512

All five algorithms offered here produce a digest, but they are not interchangeable in terms of security. MD5 (128-bit output) has been considered cryptographically broken since 2004 — researchers can construct two different files that hash to the same MD5 digest, which defeats the collision-resistance property entirely. SHA-1 (160-bit output) suffered a similar practical collision attack in 2017 (the "SHAttered" attack) and is now deprecated for any security-sensitive use, though both remain in use for non-adversarial purposes like quick checksums where nobody is deliberately trying to forge a match. The SHA-2 family — SHA-256, SHA-384, and SHA-512 — has no known practical collision attacks and remains the standard choice for anything security-relevant today, including TLS certificates, code signing, and git's newer object format. This tool includes MD5 and SHA-1 for compatibility with legacy systems and identifiers you may need to reproduce, not as a recommendation to use them for anything new.

Common use cases

Checksums are the most everyday use: a downloaded file's published SHA-256 digest lets you confirm the copy on your disk matches the original byte-for-byte, catching corruption during transfer or a tampered mirror. Git uses hashes (historically SHA-1, moving to SHA-256) as the identifier for every commit, tree, and blob in a repository — the hash of a commit's content, including its parent's hash, is what makes the commit history tamper-evident, since changing anything upstream changes every hash downstream of it. Deduplication systems use hashes to detect identical files or blocks without comparing their full contents. API integrations sometimes use a hash of a request body as an integrity check or idempotency key. In all of these cases, the hash function's job is to answer "is this the same data I expect?" cheaply and reliably.

Why this isn't the right tool for password storage

Hashing a password with SHA-256 and storing the digest is a common mistake. General-purpose hash functions are designed to be fast, which is exactly the wrong property for password storage — a fast hash lets an attacker who steals a database try billions of candidate passwords per second against it. Password storage calls for algorithms deliberately designed to be slow and memory-hard, such as bcrypt, scrypt, or Argon2, which include a per-password salt and a tunable work factor specifically to make large-scale guessing expensive. If you're building authentication, use your framework's password hashing helper (Laravel's Hash::make() uses bcrypt by default) rather than any of the algorithms offered by this tool.

Hashing files vs. text

Hashing text or a JSON object here runs entirely in your browser using the Web Crypto API, and for MD5 (not supported by Web Crypto) falls back to a server-side computation. Hashing a file works the same way for the SHA family — the file's bytes are read and digested locally without being uploaded — which means large files are hashed quickly and never leave your machine unless MD5 is selected, in which case the file is sent to the server to compute the digest.