Free Tool
Hashing Algorithm Explorer
Three hash functions, one input, three fingerprints. Type text below and this explorer shows you its MD5, SHA-256 and SHA-512 hashes side by side, so you can see how the outputs differ in length — and how they all change completely when you change a single letter. That comparison is the fastest way to understand what makes a hash secure.
MD5 is included for comparison only. It is broken for security use, and its presence here is the lesson: same input, same idea, but a fingerprint that can be forged. For anything that matters, use SHA-256 or SHA-512.
What this tool does
A hash function turns any input into a fixed-length fingerprint. The three on this page are the ones you will meet most often: MD5, from 1992, with a 128-bit output; SHA-256, with a 256-bit output; and SHA-512, with a 512-bit output. All three are deterministic — the same input always gives the same fingerprint — and all three show the avalanche effect, where changing one letter changes the whole output. The difference between them is not what they do but whether they can be trusted: MD5 can be broken by forging a collision, while SHA-256 and SHA-512 have no known practical attack.
This explorer puts the three side by side on your own text, so the differences are visible instead of abstract. You can see the outputs grow from 32 hexadecimal characters for MD5, to 64 for SHA-256, to 128 for SHA-512. You can change one letter of the input and watch all three fingerprints change completely. And you can hash the empty string and compare the results with the published test vectors, which is how you verify that a hash tool is working correctly.
The explorer is the comparison page for the three dedicated hash generators on this site — the MD5 demonstrator, the SHA-256 generator and the SHA-512 generator — each of which goes deeper into its own algorithm. Start here to see the family together, then follow the links for the detail.
Try it
Type text and hash it with all three algorithms at once. Then change one letter and hash again.
MD5 (128-bit, broken — for comparison only): press Hash with all three.
SHA-256 (256-bit): press Hash with all three.
SHA-512 (512-bit): press Hash with all three.
How it works
All three algorithms work the same way in outline: they process the input in blocks, mixing each block into a running state through many rounds of additions, rotations and bitwise operations, until the state becomes the fingerprint. The state is 128 bits for MD5, 256 for SHA-256 and 512 for SHA-512. The mixing spreads every input bit across the whole output, which is what creates the avalanche effect: flip one bit of the input and about half the output bits change, so the two fingerprints look unrelated.
The difference between them is in the details of the mixing, and that is where MD5 fails. Its mixing functions turned out to have a structure that lets an attacker construct two different inputs with the same fingerprint — a collision — far faster than chance would allow. SHA-256 and SHA-512 were designed with that lesson learned, and no practical collision has ever been found for either. The explorer shows you the results, not the internals, but the point it makes is visible in the output: the three fingerprints look equally random, and only one of the three is broken. Appearance tells you nothing about security.
This page computes MD5 with a self-contained implementation in the page, and SHA-256 and SHA-512 with your browser's built-in Web Crypto API. The SHA functions need a secure context (HTTPS); if that is unavailable, the page says so and still shows the MD5 result, rather than failing silently. Nothing you type is sent anywhere, and the page works offline once loaded.
Limitations
This explorer compares hash outputs; it does not test whether a hash is secure, and a hash that looks random is not necessarily safe. MD5 looks exactly as random as SHA-256, and it is broken. Security comes from the algorithm's resistance to attack, not from the appearance of its output — and the only honest way to know is the published research, which this page summarises rather than replaces.
- MD5 is included for comparison and teaching only. Never use it for security — passwords, signatures, or integrity checks that matter.
- A longer hash is not automatically more useful. SHA-256 is already far beyond practical attack, and SHA-512's advantage is a margin against the future.
- The SHA functions need a secure context (HTTPS). If Web Crypto is unavailable, the page says so instead of showing a wrong result.
Examples
Example 1 — Hello, world, three ways. Hashing Hello, world gives three fingerprints: 32 characters for MD5, 64 for SHA-256, 128 for SHA-512. All three are deterministic, and all three are different from each other — each algorithm produces its own fingerprint of the same input, and there is no way to convert one into another.
Example 2 — the avalanche effect, times three. Hash Hello, world, then hash Hello, worle — one letter changed. All three fingerprints change completely, sharing almost nothing with the originals. That is the property that makes hashes useful for detecting tampering: any change, however small, is immediately visible in the output.
Example 3 — the empty string test vectors. Hash the empty string and compare with the published values: MD5 d41d8cd98f00b204e9800998ecf8427e, SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, SHA-512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e. If a tool matches all three, it is computing correctly. If it does not, the tool is broken — and this page lets you check it yourself.
Frequently asked questions
What is the difference between MD5, SHA-256 and SHA-512?
Output size and security. MD5 produces a 128-bit fingerprint and is broken — collisions can be forged. SHA-256 produces 256 bits and SHA-512 produces 512 bits, and neither has a known practical attack. All three are deterministic and show the avalanche effect.
Why is MD5 broken if its output looks random?
Because security is not about appearance. MD5's internal structure lets an attacker construct two different inputs with the same fingerprint, far faster than chance. A hash can look random and still be forgeable — which is why published research, not appearance, decides whether a hash is safe.
Which hash should I use?
SHA-256 for most purposes; SHA-512 where a larger margin or 64-bit speed matters. Never MD5 for security. For passwords, neither directly — password storage needs a slow, salted process designed for that job.
What is the avalanche effect?
The property that a tiny change in the input produces a completely different output. It is what makes a hash useful for detecting tampering: change one character of a file and its hash changes entirely.
Can two different inputs have the same hash?
In theory, yes — that is a collision. For a secure hash, finding one by chance is infeasible. For MD5, attackers can construct one deliberately, which is exactly why MD5 is broken.