Hash Test Vectors

Hash Test Vectors

Updated August 17, 2026

Check whether a digest matches published RFC 1321 / FIPS 180 example strings. Not a password cracker.

This is not a password cracker

It only compares a digest to a short list of published test strings from RFC 1321 and FIPS 180 (empty string, abc, the fox sentence, and similar). Hashes cannot be decrypted. We do not run dictionary attacks or accept custom wordlists.

Hex digest

Inputs we check (8)

  • (empty string)
  • a
  • abc
  • message digest
  • abcdefghijklmnopqrstuvwxyz
  • abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq
  • The quick brown fox jumps over the lazy dog
  • The quick brown fox jumps over the lazy dog.

Features

  • Compare a hex digest to published RFC 1321 and FIPS 180 test strings
  • Supports MD5, SHA-1, SHA-256, and SHA-512
  • Shows the exact published input when there is a match (including the empty string)
  • Runs in the browser. No wordlists, no password dictionaries, no uploads

Common Use Cases

  • Confirm your own hasher matches the MD5 of "abc" from RFC 1321
  • Teach the difference between a test vector and reversing a hash
  • Sanity-check a copy-pasted digest before you trust a checksum in docs

Test vectors, not reverse hashes

A cryptographic hash is one-way. You cannot decrypt MD5 or SHA-256. What you can do is hash a known input and see if the digest matches. Standards bodies publish those known inputs so implementers can check their code.

This page hashes a short list of those published strings (empty, a, abc, message digest, the alphabet, and the fox sentence) and compares the result to what you pasted. If it matches, your digest is one of those examples. If it does not, the digest may still be valid. It is simply not in this tiny set.

We do not provide password dictionaries, rainbow tables, or wordlist upload. Those would help people attack other people's hashes. For your own password strength, use the Password Tester. For storing passwords, use Argon2 or bcrypt, not raw SHA-256.

Examples

Valid - RFC 1321 MD5 of abc
Input: abc
MD5: 900150983cd24fb0d6963f7d28e17f72
Valid - Empty string SHA-256
Input: (empty)
SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Invalid - A random digest is not a test vector
Input hash: 5f4dcc3b5aa765d61d8327deb882cf99
Result: not in the published set (that digest is MD5 of a common word, which we do not search for)

Frequently Asked Questions

Can this recover a password from a hash?

No. It only recognizes a handful of published example strings. That is how you verify a hash implementation, not how you attack a password database.

Why did a real checksum not match?

Because it is not one of the RFC/FIPS examples. Compute the file or text with the Hash Generator or File Checksum tool instead.

Where do the example strings come from?

MD5 examples follow RFC 1321. SHA examples follow the usual FIPS 180 test strings used in countless implementations (empty string, abc, fox sentence).

Tips

  • Use this after you write a hasher, not against production password hashes.
  • If you need to store passwords, use a password hashing scheme with a unique salt (Argon2, bcrypt). Raw SHA-256 is the wrong tool.

Common Mistakes

Treating "not in the published set" as "invalid hash". Most valid digests are not test vectors.
Pasting a salted password hash and expecting a match. Test vectors are unsalted example strings.

Related Tools

Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-512, or CRC32 from text or a file.

Try it

Password Tester

Estimate strength of a password you are choosing, locally.

Try it