Password hash generator
Enter a password below to see it hashed with several common algorithms side by side, and to understand which of them is actually appropriate for storing real user passwords.
What a password hash generator actually does
A password hash generator takes the plain text a user types into a login form and runs it through a one-way mathematical function, producing a fixed-length string called a digest or hash. Instead of storing "hunter2" in a database column, an application stores the hash of "hunter2." When the user logs in again, the application hashes whatever they typed and compares the two hashes — it never needs to store, or even see, the original password again.
This page lets you experiment with that process directly: type a password into the field above and watch the MD5, SHA-1, SHA-256, and SHA-512 hashes update live, entirely inside your browser.
Not every hash belongs in a password column
This is the single most common misunderstanding search engines see people run into. MD5, SHA-1, SHA-256, and SHA-512 are general-purpose hash functions. They were designed to be computed as fast as possible, which is perfect for checksumming a file but a serious liability for a password column, because it means an attacker who steals your database can try billions of password guesses per second against every hash in it using off-the-shelf GPU hardware.
Purpose-built password hashing algorithms — bcrypt, Argon2, scrypt, PBKDF2 — solve this by being deliberately, tunably slow, and by folding in a unique random salt automatically so that identical passwords never produce identical hashes. If you're building or reviewing a real authentication system, use our bcrypt password hash generator instead of a raw digest.
When a fast hash (MD5/SHA-256) of a password is fine
- Generating a non-secret, deterministic cache key from a password reset token (not the password itself).
- Coursework or demonstrations where you're teaching the concept of hashing, not building production auth.
- Producing a checksum of a password file for integrity checking (rare, and not the same as authentication).
Outside of cases like these, treat a bare MD5 or SHA-256 hash of a password as unsuitable for anything facing real users.
Add a salt if you're using a general-purpose hash
If your use case genuinely calls for SHA-256 rather than bcrypt, at minimum combine it with a per-user random salt using HMAC rather than simple string concatenation. Our SHA-256 with salt tool and MD5 with salt tool demonstrate both the append/prepend and HMAC approaches and explain why HMAC is the stronger of the two.
Strength check included
Because this page is specifically about passwords, it also includes a live strength meter above the hash output — checking length, character variety, and the presence of numbers and symbols — so you can evaluate the password itself, not just its hash.
Frequently asked questions
What is the best algorithm for a password hash generator?
For real authentication systems: bcrypt, Argon2, or PBKDF2. For everything else (checksums, demos, non-authentication use cases), SHA-256 is a reasonable general-purpose choice.
Why do I see a different hash every time I hash the same password with bcrypt?
bcrypt automatically generates a new random salt each time you hash, and embeds that salt inside the output string, so identical inputs produce different-looking hashes. This is intentional and is what defeats precomputed rainbow-table attacks.
Should I salt MD5 or SHA-256 manually?
If you must use a general-purpose hash, yes — always add a unique, random, per-record salt using HMAC. But for password storage specifically, switching to bcrypt or Argon2 is the better fix, since they handle salting and cost-tuning for you.