Is my input sent to a server?

No. Hashing uses the Web Crypto API in your browser, the same implementation your own code would call.

Can a hash be reversed?

No. Services that appear to reverse one are looking the digest up in a table of pre-computed common inputs. That works alarmingly well on short or predictable values, which is an argument for salting rather than against hashing.

Why is MD5 not offered?

Because collisions in MD5 can be produced deliberately and cheaply, which disqualifies it from every security use it is still reached for. If you need it for a legacy checksum, use a tool that offers it - this one takes the position that it should not.

Which algorithm should I use?

SHA-256 unless something specific tells you otherwise. SHA-1 is present for checking against existing values, not for producing new ones. For passwords use none of these - use bcrypt, scrypt or Argon2.

A CyberChef alternative for when you want one hash, not a workbench

CyberChef is the most capable tool of its kind that exists, it runs entirely in your browser, and this page is not going to pretend otherwise. The comparison is about shape rather than power: a workbench you assemble a recipe on, against a field that gives you a digest.

Open the Hash Generator →

CyberChef and Softland, side by side

	CyberChef	Softland
Getting to an answer	Find the operation, drag it into a recipe, set the options	Paste, pick an algorithm, read the digest
Algorithms offered	Dozens, including MD5 and the whole HMAC family	SHA-1, SHA-256, SHA-384, SHA-512
MD5	Available	Deliberately absent
Hashing a file	Yes, by dropping it in	Text only
Chaining operations	The entire point of it	Not offered

Both run locally, so that is not the argument

CyberChef executes in the browser tab, which is exactly why it can be handed things that would never be acceptable to upload. This tool uses the Web Crypto API built into the same browser. Neither transmits your input, and anyone telling you otherwise about either is selling something.

What differs is the distance between opening the page and having the answer. A recipe-based tool is a superb environment for a problem you have to think about - decode this, then decompress it, then try it as a different character set. It is a long way round for the question of what the SHA-256 of a string is, which is the question most people arrive with.

Why MD5 is not on the list

MD5 is broken for any purpose that depends on two different inputs not producing the same digest. Collisions can be manufactured cheaply and deliberately, which rules it out for signatures, for integrity checks against a hostile party, and for anything security-adjacent. It survives mainly through habit and through file checksums published a decade ago.

Omitting it is an opinion rather than a technical limitation, and it is a defensible one only because the alternative is a click away: if you have a legitimate reason to compute an MD5 - verifying a download whose published checksum is MD5, matching a legacy database column - CyberChef will do it and this will not.

What hashing is and is not for

A hash is one-way. There is no operation that turns a digest back into its input, and a site claiming to reverse one is either looking the value up in a table of pre-computed common inputs or guessing. That is precisely why unsalted hashes of predictable values - passwords, email addresses, phone numbers - offer far less protection than people assume.

For passwords specifically, none of the SHA family is the right answer. Those are designed to be fast, and fast is the opposite of what a password hash needs. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted. Use SHA-256 for content addressing, integrity checks, deduplication and signatures.

When CyberChef is the better choice

You need MD5, HMAC, or any algorithm outside the four SHA variants here.
You are hashing a file rather than a string.
The job is a chain - decode, decompress, decrypt, then hash - which is what a recipe-based tool exists for.
You are analysing something unknown and need the whole toolbox rather than one tool from it.

Frequently asked questions

Is my input sent to a server?: No. Hashing uses the Web Crypto API in your browser, the same implementation your own code would call.
Can a hash be reversed?: No. Services that appear to reverse one are looking the digest up in a table of pre-computed common inputs. That works alarmingly well on short or predictable values, which is an argument for salting rather than against hashing.
Why is MD5 not offered?: Because collisions in MD5 can be produced deliberately and cheaply, which disqualifies it from every security use it is still reached for. If you need it for a legacy checksum, use a tool that offers it - this one takes the position that it should not.
Which algorithm should I use?: SHA-256 unless something specific tells you otherwise. SHA-1 is present for checking against existing values, not for producing new ones. For passwords use none of these - use bcrypt, scrypt or Argon2.

Try it yourself

SHA-1, SHA-256, SHA-384 and SHA-512 digests.

Open the Hash Generator

CyberChef is a trademark of its respective owner. Softland is not affiliated with, endorsed by or sponsored by CyberChef. This comparison reflects how each product works rather than what either costs, because pricing and plan limits change; check CyberChef’s own site for its current terms.