Hash Generator (SHA-256, SHA-1, SHA-512)
Compute SHA-256, SHA-384, SHA-512 and SHA-1 hashes of any text, entirely in your browser.
SHA-1 is broken for security purposes — practical collisions were demonstrated in 2017. Use it only to match an existing legacy checksum, never for signatures or passwords.
This tool runs entirely in your browser. Nothing you enter is uploaded to a server.
Compute a SHA-256, SHA-384, SHA-512 or SHA-1 hash of any text, updating as you type. It uses the Web Crypto API built into your browser — the same implementation used for HTTPS — so nothing you paste is transmitted anywhere.
How to use it
- Paste your textThe hash is recomputed on every keystroke. Even a one-character change produces a completely different result.
- Choose an algorithmSHA-256 is the sensible default. SHA-1 is offered only for checking against legacy systems.
- Copy the hashSelect the output, or switch to uppercase first if the system you are comparing against uses it.
What hashes are actually for
A hash answers one question well: has this data changed? Download a file, hash it, compare against the publisher's figure, and a mismatch tells you something is wrong — corruption in transit, or tampering. Because a single altered bit changes the entire output, there is no such thing as a near match.
The same property underpins a great deal of infrastructure. Git names every commit by the hash of its contents. Blockchains chain blocks by hash. Digital signatures sign a hash rather than a whole document, because the hash is small and stands in for the document exactly.
Choosing an algorithm
Use SHA-256 unless you have a specific reason not to. It is secure, fast, and universally supported, which means the system on the other end almost certainly expects it. SHA-384 and SHA-512 produce longer digests and can be quicker on 64-bit processors; pick them when something you are integrating with asks for them.
SHA-1 is here for one reason: older systems still publish SHA-1 checksums, and you occasionally need to verify against one. It is cryptographically broken and should never be chosen for anything new.
The password mistake
The most common misuse of a tool like this is hashing passwords with SHA-256 and storing the result. It feels responsible and is not. General-purpose hashes are built to be fast, and speed is precisely what an attacker with a stolen database wants — commodity hardware can test billions of candidate passwords per second against a fast hash.
Password hashing needs the opposite: a function deliberately made slow and memory-hungry, with a unique salt per user so identical passwords do not produce identical hashes. Argon2, scrypt and bcrypt exist for this. If you are storing credentials, reach for one of those, not for this page.
Privacy
Hashing runs through the Web Crypto API, built into the browser and the same code path used to secure HTTPS connections. There is no library to trust and no request to intercept — your text never leaves the tab. That matters because the values people want to hash are often exactly the values they should not paste into a website: keys, tokens, internal identifiers.
Frequently asked questions
What is a hash?
A fixed-length fingerprint of some data. The same input always gives the same output, but the process cannot be reversed to recover the input, and changing a single character produces a completely different hash. That makes hashes useful for checking that something has not been altered.
Can I get the original text back from a hash?
No. Hashing is one-way by design. For short or common inputs an attacker can guess candidates and hash them until one matches, which is why hashing alone is not enough to protect passwords — but you cannot invert the function itself.
Should I use this to hash passwords?
No. Plain SHA-256 is far too fast, which is exactly wrong for passwords: modern hardware can try billions of guesses per second. Passwords need a deliberately slow algorithm with a per-user salt, such as bcrypt, scrypt or Argon2. Use this tool for integrity checks, not credential storage.
Is SHA-1 safe?
Not for security. A practical collision was demonstrated in 2017, meaning two different inputs can be constructed with the same SHA-1 hash. It remains useful only for matching an existing legacy checksum, never for signatures, certificates or anything where an attacker could supply the input. The tool warns you when SHA-1 is selected.
What is the difference between SHA-256 and SHA-512?
The digest length, and the internal word size. SHA-512 produces a 512-bit hash and is often faster on 64-bit hardware despite being longer. Both are considered secure; SHA-256 is more widely expected by other systems, which is usually the deciding factor.
Why does my hash differ from another tool's?
Almost always a difference in input, not algorithm. A trailing newline, a space, or text saved with Windows line endings will change the hash completely. Files also hash differently from the text they contain. Check the input matches byte for byte before suspecting the algorithm.
Can it hash a file?
Not yet — this tool works on text. File hashing is on the roadmap and will work the same way, reading the file locally without uploading it.
Is my text sent anywhere?
No. Hashing uses the Web Crypto API inside your browser. Nothing is transmitted, which matters given people often hash values they would never paste into a website.