What is a password hash?
A hash function turns any input into a fixed-length fingerprint. The same input always gives the same output, but you cannot run the function backwards. Websites store hashes instead of passwords: at login they hash what you typed and compare fingerprints. If the database leaks, attackers get hashes, not passwords — and have to guess inputs until one matches.
The algorithms on this page
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 128-bit (32 hex) | Broken for security. Fine only for checksums. |
| SHA-1 | 160-bit (40 hex) | Collision attacks demonstrated (2017). Legacy only. |
| SHA-256 | 256-bit (64 hex) | Secure for integrity and signatures. |
| SHA-384 / SHA-512 | 384 / 512-bit | Secure; SHA-512 is faster on 64-bit CPUs. |
| NTLM | 128-bit (MD4 of UTF-16LE) | Windows legacy hash; extremely fast to crack. |
Don’t store passwords with plain SHA-256
SHA-256 is an excellent hash — but it is fast, and fast is bad for passwords. A GPU can compute billions of SHA-256 hashes per second, so a stolen table of unsalted SHA-256 password hashes falls quickly to dictionary attacks. For storing passwords, use a deliberately slow, salted password hashing function:
- Argon2id — the current first choice (OWASP recommendation).
- scrypt — memory-hard, widely available.
- bcrypt — battle-tested since 1999, supported everywhere. Try our bcrypt generator.
- PBKDF2 — acceptable when FIPS compliance is required, with a high iteration count.
Common uses for this tool
- Checking that your code produces the expected digest for a known input.
- Comparing a file checksum or API signature by hand.
- Creating test fixtures, or computing an NTLM hash for a lab environment.
- Learning: see how changing one character completely changes every hash (the “avalanche effect”).
Input is encoded as UTF-8 for all algorithms except NTLM, which by definition uses UTF-16 little-endian. SHA hashes come from the browser’s built-in Web Crypto API; MD5 and MD4 are implemented locally because browsers deliberately omit them.
Last updated: · Reviewed by the Password Generator team