digest.hex — 3 tools ● LIVE
Input · preimage 0 CHARS
NETWORK PAYLOAD: 0 BYTES · PROCESSING: LOCAL
Digest · live — IDLE
UPDATES ON EVERY KEYSTROKE
Input bytes0UTF-8 ENCODED
Digest width128ALGORITHM BITS
Hex chars32DIGEST LENGTH
Compute0.00MILLISECONDS

Developer Tools · Group 09 of 19

Hash Tools.

Three one-way functions, three widths — 128, 160 and 256 bits. Type anything and watch it collapse into a fixed-length hex fingerprint on every keystroke: flip one bit of the input and roughly half the digest flips with it. The input is read as UTF-8 bytes, so Persian and emoji hash correctly, and the classic fox test vector is one click away for verification. Deterministic, irreversible, and computed entirely in your tab — nothing is uploaded, nothing is stored.

  • Tools03
  • Widths128–256
  • One-wayyes
  • Backendnone
  • Costfree
In order, 01 → 03

Three widths, one avalanche, zero servers.

( 01 )

The 1991 workhorse that still refuses to retire. MD5 folds any input into a 128-bit digest — 32 hex characters — in 512-bit blocks, and it does it fast. It has been collision-broken since 2004 and is trivially forgeable today, so it has no place near passwords, signatures or certificates. But as a quick, non-adversarial fingerprint — checksums, cache keys, dedup, change detection — it remains exactly what it always was: cheap and good enough. The bench shows the digest byte-by-byte, with the block count and compute time alongside.

Example · the classic test vector

The quick brown fox jumps over the lazy dog

9e107d9d372bb6826bd81d3542a419d6 matches the published value — hit ↺ Fox sample to see the badge.

Use it for checksumscache keysdeduplegacy systems

NSA's 1995 design produces a 160-bit digest — 40 hex characters — and for two decades it signed the web's certificates. Then SHAttered (2017) produced a real collision, and it was retired from security duty. Today it lives on in legacy corners — old version-control fingerprints, protocol compatibility, non-adversarial content IDs — where its width and speed still earn their keep. Anything security-sensitive should move to SHA-256, which is one tab away.

Example · the classic test vector

The quick brown fox jumps over the lazy dog

2fd4e1c67a2d28fced849ee1bb76e7391b93eb12 40 hex characters · 160 bits · one block for this input.

Use it for legacy compatfingerprintscontent IDsmigration audits

The current standard. SHA-256 compresses any input into a 256-bit digest — 64 hex characters — and has no practical attacks after two decades of scrutiny. It underpins TLS handshakes, code-signing, blockchain, file integrity and the salted password pipelines that wrap it. If one of these three algorithms is going anywhere near something an attacker might care about, this is the one. The avalanche is on full display: change the last character of the input and the whole digest reshuffles.

Example · the classic test vector

The quick brown fox jumps over the lazy dog

d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592 64 hex characters · 256 bits · the safe default.

Use it for signaturesintegrityblockchaintamper detection

Hashing rules · the input is encoded as UTF-8 first, then hashed — the algorithms see bytes, not characters, so Persian and emoji hash to their real byte sequences · hashing is deterministic: same bytes in, same digest out, on every machine · it is also one-way: the digest cannot be reversed, only brute-forced — which is why passwords need slow salted hashes, not raw MD5 · the avalanche effect flips roughly half the output bits for every flipped input bit · MD5 and SHA-1 are collision-broken and must not be used for security · SHA-256 is the current standard · hex case is cosmetic — the bytes underneath are identical · ⇄ Output → Input feeds the digest back for a hash-of-a-hash

The privacy promise

Hash anything. We couldn't read it even if we wanted to.

This page has no backend and no database. Every byte folded, every block processed and every hex character emitted just now was computed by JavaScript inside your own browser tab — your input never traveled a single centimeter of cable. And even if it had, a hash is one-way: the preimage stays with you, always. Close the page and the input is gone for good.

✕ SERVER · DATABASE · LOGS · ANALYTICS
  • Databasenull
  • Backendnone
  • Input uploads0
  • Reversiblenever
Questions

Asked often, answered plainly.

( 02 )
Can you reverse a hash back to the original text?

No — cryptographic hashes are one-way by design. There's no decryption; the only way back is guessing, via brute force or dictionary attacks against short, predictable inputs. That's exactly why passwords should never be stored as raw MD5 or SHA — they need slow, salted password-hashing functions like bcrypt or Argon2, which make each guess expensive.

Why does my text hash to more bytes than it has characters?

Because the algorithms hash bytes, not characters, and this bench encodes your text as UTF-8 first. ASCII characters are one byte each, but Persian letters are two bytes and emoji are four — so the Input bytes readout can be well above the character count. The same text always produces the same bytes, and therefore the same digest, on every machine.

Which algorithm should I use?

SHA-256 for anything an attacker might care about — signatures, integrity checks, tamper detection, anything security-related. MD5 and SHA-1 both have practical collision attacks and are deprecated for security; keep them only for checksums, cache keys, deduplication and legacy compatibility where nobody is deliberately crafting malicious input.

Are MD5 and SHA-1 still useful for anything?

Yes — just not for security. A broken hash still works perfectly as a fast fingerprint when there's no adversary: file checksums, cache keys, content deduplication, change detection, database sharding. The collision attacks only matter when someone can deliberately craft two different inputs that produce the same digest, and that takes real resources.

Is my data saved anywhere?

No. IrisTool has no backend and no database. Hashing happens inside your browser tab and the input disappears the moment you close or refresh the page. There is nothing to leak, because nothing is ever collected — and even a hash of it never leaves your machine.