Hash generator

Which one, and when

If you have no particular reason to choose, choose SHA-256. It is the modern default, it is what other systems will expect, and the cases where its length is genuinely a problem are rare enough that you would know.

"Broken" does not mean useless

MD5 and SHA-1 are described as broken, and both descriptions are correct, but the failure is specific. Someone can deliberately construct two different inputs that produce the same MD5 — that is a collision, and it means MD5 cannot prove a document is the one you were shown. It does not mean MD5 fails at random: two files that differ by accident still produce different hashes with overwhelming probability.

So MD5 remains a perfectly reasonable fingerprint for a cache key, a deduplication check or a corrupted download, and it remains published everywhere for exactly that reason. What it must not do is stand in for a signature. The question to ask is whether anyone benefits from fooling you. If they do, use SHA-256.

The trailing newline problem

The single most common reason two tools disagree about a hash is one extra byte at the end. A file saved by an editor usually ends with a newline; text copied out of a web page usually does not; echo "abc" in a shell adds one and echo -n "abc" does not. The hashes differ completely, which is what makes it confusing — a one-byte difference does not produce a nearly-right answer.

The character and byte counts above the results exist for this. If your text is five characters and the other tool says six bytes, you have found it. Note also that the two counts differ for anything non-ASCII: a é is one character and two bytes, and hashing works on bytes, which is why UTF-8 is the encoding used here.

Hashing is not encryption, and it is not password storage

Encryption is reversible with a key; hashing is not reversible at all. That is not a limitation, it is the feature — a hash lets you check whether something matches without keeping the thing itself.

Which is precisely why people reach for it to store passwords, and why doing it with SHA-256 is a mistake. These algorithms are built to be fast, so an attacker with a stolen database can test billions of guesses per second on hardware that costs very little. Password hashing needs the opposite property: bcrypt, scrypt and Argon2 are deliberately slow and deliberately memory-hungry, and each password gets its own salt so that one cracked hash reveals nothing about the next. If you are building authentication, use one of those.

Why the text stays in your browser

Think about what actually gets pasted into a hash generator. An API key someone is fingerprinting. A token from a config file. A password being checked against a leaked list. A customer email address being hashed for an analytics identifier. This is close to a worst-case set of strings to hand to a stranger's server.

None of it goes anywhere here. The MD5 implementation is a few hundred lines of JavaScript running in this tab and the SHA family comes from the browser's own WebCrypto, which is the same code your browser uses for TLS. Open the Network tab and type — nothing moves.

Questions

How do I generate an MD5 hash of a string?

Type or paste the text and the MD5 appears immediately, along with SHA-1, SHA-256, SHA-384, SHA-512 and CRC32. All six are shown at once because working out which one you need is often the actual question.

Can an MD5 hash be reversed?

Not by calculation — hashing throws information away, and no amount of arithmetic gets it back. What can be done is guessing: an attacker hashes billions of candidate strings and looks for yours. For anything short or common that succeeds in seconds, which is why an unsalted MD5 of a password is effectively plaintext.

Why do I get a different hash from another tool?

Almost always a trailing newline. Text areas, files and terminals disagree about whether the last line ends with one, and a single extra byte changes the hash completely. The character and byte counts shown above the results will usually tell you which of you has the extra one.

Is MD5 still safe to use?

Not for anything where an attacker gets a say. Two different inputs with the same MD5 can be constructed in seconds on a laptop, so it cannot prove a document is unaltered. It is perfectly fine as a cheap fingerprint for cache keys, deduplication and spotting accidental corruption — the failure is adversarial, not accidental.

Which hash should I use for passwords?

None of these. Password storage needs a deliberately slow algorithm with a per-user salt — bcrypt, scrypt or Argon2 — because the whole point is to make billions of guesses expensive. SHA-256 is fast, and fast is exactly the wrong property. This page hashes text; it is not a password store.

What is the difference between a hash and encryption?

Encryption is two-way: with the key you get the original back. Hashing is one-way by design and there is no key — the output is a fingerprint, not a container. If you need the text back afterwards, you want encryption, not a hash.

Is the text I type sent anywhere?

No. That matters here more than almost anywhere else on this site, because the text people paste into a hash tool is routinely an API key, a token, a password they are checking, or a customer record. It is hashed in this tab by your browser and no request carries it.

What BriskFile will not do to you

• Your files never leave your device

  Every conversion runs in your browser. Open DevTools, watch the Network tab, and you will see no upload — because there is not one.

• No account, no email, no watermark

  Nothing to sign up for and nothing stamped on your images. There is no step between choosing a file and getting it back.

• No limits at the download button

  No daily cap, no file counter, no "upgrade to download". If the tool starts a job, it finishes it.

• Checkable, not just claimed

  Open the Network tab and convert something — nothing goes out. Or load the page, disconnect, and watch it keep working: the tool is already on your machine, and your file never leaves it.