This page is the canonical guide to computing MD5, SHA-1, and SHA-256 digests with DevUtilities’ Hash Generator. Use the workspace above while you read, or jump to a topic below. Digests run via Web Crypto in your browser — inputs never leave your machine.

Hash Generator produces deterministic hexadecimal digests for pasted UTF-8 text using MD5, SHA-1, and SHA-256 side by side. It is built for checksums, integrity comparisons, and legacy compatibility — not for storing passwords or proving authenticity alone.

What you get

• Simultaneous MD5, SHA-1, and SHA-256 hex outputs for the same input
• Client-side digests via crypto.subtle (and MD5 for legacy checksum workflows)
• Copy-friendly output for CI scripts and release notes
• Pipe-friendly chaining from Base64 / URL Encoder workflows

Use this generator when

• You need a quick SHA-256 of a config string or manifest line
• You are matching a published MD5/SHA-1 checksum from a vendor (legacy)
• You want local, privacy-safe digests without a remote hashing API

Prefer other tools when

• You need keyed integrity → Crypto Toolkit HMAC mode
• You need password hashing → PBKDF2 / Argon2 / scrypt (Crypto Toolkit PBKDF2 or a backend KDF)
• You need streaming hashes of multi-GB binaries → OS or CI streaming utilities

Pick the algorithm for the job. Collision resistance and password storage requirements differ sharply across MD5, SHA-1, and SHA-256.

SHA-256 — default for integrity

Use SHA-256 for new checksums, content-addressed caches, and integrity pins when you only need an unkeyed digest. Hex length is always 64 characters (256 bits).

SHA-1 — legacy only

SHA-1 is broken for collision resistance. Keep it only when a protocol or vendor still publishes SHA-1 checksums. Do not use it for new security designs.

MD5 — checksum compatibility, not security

MD5 remains common in older package mirrors and file manifests. It is not collision-resistant. Never use MD5 for signatures, certificates, or password storage.

Not for passwords

Fast hashes are designed to be quick. Password storage needs slow, salted KDFs: PBKDF2, scrypt, or Argon2. Use Crypto Toolkit’s PBKDF2 mode or your identity platform’s recommended hasher.

Compute a reproducible digest with the generator above.

1. Paste the exact UTF-8 string you intend to hash — include or exclude trailing newlines deliberately.
2. Review MD5, SHA-1, and SHA-256 hex lines in the output panel.
3. Copy the algorithm your pipeline expects (prefer SHA-256 for new work).
4. If comparing to openssl or another tool, match encoding and newline handling byte-for-byte.
5. For secrets, prefer test vectors only; clear the editor when finished.

Problem: a release notes page publishes SHA-256 checksums for downloadable text manifests, and you need to verify a copied blob before deploy.

How this tool helps

1. Paste the manifest text exactly as shipped (watch CRLF vs LF).
2. Compare the SHA-256 line to the published checksum.
3. If only MD5 is published (legacy vendor), use the MD5 line knowing it is weaker.
4. Fail the deploy if digests differ — do not “fix” by re-hashing a reformatted copy.

Outcome: a fast local checksum gate before promoting artifacts.

Problem: two services disagree on whether a shared config string changed. You need a stable fingerprint without standing up a signing service.

How this tool helps

1. Normalize the string (encoding, trim policy) the same way both services will.
2. Generate SHA-256 and store or compare the hex digest.
3. On mismatch, diff the raw strings — the hash only signals change, not what changed.

Outcome: a simple integrity fingerprint. For authenticity against attackers, add HMAC or signatures (Crypto Toolkit / backend keys).

Problem: a prototype stored SHA-256(password) in a database. Security review rejected it.

How this tool helps

1. Use this page only to demonstrate that fast digests are instant to compute (and thus weak for passwords).
2. Switch to Crypto Toolkit PBKDF2 (or Argon2/bcrypt in your backend) with a unique salt and high iteration count.
3. Migrate existing SHA-256 password rows via re-hash-on-login or forced reset.

Outcome: clear separation — Hash Generator for checksums; KDFs for password storage.

MD5 and SHA-1 are not safe when an attacker can choose colliding inputs.

Why it happens

Practical collision attacks exist for MD5 and SHA-1. Two different files can share a digest, breaking “same hash ⇒ same content” assumptions in adversarial settings.

Diagnose

If your threat model includes malicious uploaders or supply-chain attackers, any MD5/SHA-1-only pin is insufficient.

Fixes

1. Prefer SHA-256 (or stronger) for new integrity pins.
2. For authenticity, use signatures or HMAC with a secret — not bare digests.
3. Keep MD5/SHA-1 only for non-adversarial legacy checksum matching.

openssl, PowerShell, and browser digests disagree when bytes differ.

Why it happens

UTF-8 vs Latin-1, trailing newlines, BOM, and hashing a filename vs file contents all change the digest.

Diagnose

Hash a known empty string: SHA-256 of empty input is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. If tools disagree on empty input, the pipeline is wrong.

Fixes

1. Agree on UTF-8 and newline policy before comparing.
2. Hash raw file bytes for binaries — this UI hashes pasted text, not arbitrary file streams.
3. Confirm hex vs Base64 output encoding in the other tool.

Storing MD5/SHA-1/SHA-256 of passwords is a critical design error.

Why it happens

Unsalted or fast hashes fall to GPU cracking and rainbow tables. Digests here are optimized for speed, not password hardening.

Diagnose

If login verification is a single hex compare of SHA-256(password), you need a KDF migration.

Fixes

1. Use PBKDF2 (Crypto Toolkit), Argon2, or bcrypt with unique salts.
2. Never reuse a global salt; store salt beside the hash.
3. Treat this Hash Generator as educational for password topics — not as a hasher for production credentials.

Short matrix of algorithms exposed in this workspace and when each is appropriate.

• Digests are not encryption and do not provide confidentiality.
• Unkeyed hashes do not prove authenticity — use HMAC or signatures when attackers can modify data.
• Do not paste production passwords into the input panel.
• MD5 and SHA-1 are provided for compatibility, not modern security.

• Default new pins to SHA-256; document encoding and newline rules next to the digest.
• For downloadable artifacts, publish algorithm name with the hex string.
• Pipe text through formatters only when the hashed bytes are meant to be normalized.
• Move password and API-secret hardening to KDFs and secret managers.

MD5, SHA-1, and SHA-256 digests are computed locally. Passwords, tokens, and file contents you paste are not uploaded to a remote hashing service.

• Still avoid pasting production secrets into any browser tool on a shared device.
• Optional local persistence stays on your origin only.