Why are MD5 and SHA-1 marked "weak"?

Both have practical collisions (different inputs producing the same hash). MD5 has been broken since 2004, SHA-1 since 2017. Do not use them for authentication, digital signatures, or certificates in new systems. Both are still acceptable for file checksums (no adversarial actor) and compatibility with legacy code.

What is the difference between MySQL 4.1+ and MySQL OLD_PASSWORD?

MySQL OLD_PASSWORD is a pre-2004 algorithm used in MySQL 3.23 and earlier - produces a 16-char hash, completely broken. MySQL 4.1+ uses SHA1(SHA1(password)) prefixed with "*" - still unsafe for new systems (no salt, no slow function) but the default in many MySQL/MariaDB installations to this day. Modern systems should use caching_sha2_password (MySQL 8.0+) or application-level bcrypt/argon2.

Why no bcrypt, scrypt, argon2?

They are intentionally slow salted algorithms unsuitable for live in-browser generation (each hash takes 100-1000 ms). They also require a random salt per hash, so two calls for the same password produce different outputs. Those algorithms should be computed on the backend during authentication, not in a conversion tool. To tune bcrypt cost factor for your server, use the [bcrypt cost analyzer](/en/bcrypt-cost-analyzer). For symmetric encryption of arbitrary data, use [AES encrypt / decrypt](/en/aes-encrypt-decrypt).

My password hash from the database does not match - why?

Common reasons: (1) the database uses a salt you don't know (each salt → different hash); (2) the database uses a dialect - e.g. PHP password_hash defaults to bcrypt with $2y$ prefix, not plain SHA-1; (3) the password was slightly altered (whitespace, capitalization). Check your database's docs for the exact algorithm and parameters.

Password Hashes: MD5, SHA, bcrypt

16 hash algorithms: MD4, MD5, SHA, SHA-3, RIPEMD, MySQL, NTLM, HMAC, bcrypt - with optional salt.

LiveRuns in your browser

Password hashes

Type a password - see 16 popular hash formats side by side. Optional salt (prefix/suffix), HMAC key and bcrypt with configurable rounds. Everything local.

Password to hash

Family filters

Pick which algorithm families show up in the results.

MD2tools.passwordHash.badges.weak

-

MD4tools.passwordHash.badges.weak

-

MD5tools.passwordHash.badges.weak

-

NTLMtools.passwordHash.badges.legacy

-

SHA-1tools.passwordHash.badges.weak

-

SHA-224

-

SHA-256

-

Double SHA-256

-

SHA-384

-

SHA-512

-

SHA-512/224

-

SHA-512/256

-

Whirlpool

-

CRC32tools.passwordHash.badges.checksum

-

MySQL 4.1+tools.passwordHash.badges.legacy

-

MySQL OLDtools.passwordHash.badges.weak

-

Password, salt, HMAC key and all hashes never leave your browser.

MD4, MD5 and SHA-1 are cryptographically broken - use only for migrating legacy systems. For new applications pick SHA-256+, SHA3, bcrypt or argon2.

Convert a password into common hash formats. Type a password - the tool computes MD5, SHA-1, SHA-256, SHA-384, SHA-512, MySQL 4.1+ and legacy MySQL OLD_PASSWORD locally. All computation happens in your browser - the password never leaves your machine.

How to use

Type a password in the top field. It is hidden by default - click the eye icon to reveal.
All hashes update live as you type.
Click the copy icon next to a hash to grab it for pasting elsewhere.
Some algorithms (MD5, SHA-1) are tagged "weak" - use them only for legacy migration or debugging, not for new applications.

Use cases

Migrate users between systems with different hash formats. Debug why a hash from the database does not match expectations (see all variants side by side). Test authentication in an app. Verify a hash in a MySQL config file. Education: show the differences between algorithm families.

Frequently asked questions

No. All hashes are computed locally. SHA-1/256/384/512 and MySQL 4.1+ use the Web Crypto API (crypto.subtle.digest). MD5 uses a small bundled JS library (~7 KB). MySQL OLD_PASSWORD has its own pure-JS implementation. Open DevTools Network - no request appears.

Related tools

Password Generator

Create strong, cryptographically random passwords - entirely in your browser.

Pwned Password Check

Check whether your password has leaked - without ever sending it anywhere.