Hash generator

Hashing is not encryption

Encrypted data can be decrypted by whoever holds the key. A hash cannot be reversed at all - it is a one-way fingerprint, and the original text is not in there to be recovered.

So "decrypt this MD5" is not a thing that can be done. What tools advertising it actually do is look the hash up in a table of pre-computed hashes of common strings. That works for password123 and never for anything with real entropy, which is also why hashing a password without a per-user salt is a mistake.

The URL of this page still says "encryption" because it has said so for a decade and the address is worth keeping. The word is wrong.

Which one to use

Algorithm	Output	Use it for
MD5	128 bits	Checking a download against a published checksum. Nothing else.
SHA-1	160 bits	Legacy compatibility only.
SHA-256	256 bits	The sensible default.
SHA-384 / SHA-512	384 / 512 bits	Where a longer digest is specified.

MD5 and SHA-1 are broken in the specific sense that an attacker can construct two different inputs with the same hash. MD5 collisions have been producible on ordinary hardware since 2004, and SHA-1 since 2017. If an adversary controls any part of the input - a signature, a certificate, a file you are trusting because its hash matched - neither is safe. For verifying your own download against a checksum published beside it, MD5 is still fine, and that is the honest boundary.

Passwords are a different problem

None of these should be used to store a password, however long the digest. They are designed to be fast, and fast is exactly wrong: it lets an attacker try billions of guesses a second against a stolen database.

Password storage wants a deliberately slow, salted algorithm - argon2, scrypt or bcrypt - with a work factor tuned to your hardware. In PHP that is password_hash(), which picks a sound default for you.