Hash Generator
A hash function turns any text into a fixed-length fingerprint: SHA-256 always produces 64 hexadecimal characters, and changing a single letter changes the whole result. Hashes are one-way, so they verify data without revealing it. This generator computes SHA-1, SHA-256, SHA-384 and SHA-512 of your text as you type.
SHA hashes use the browser's Web Crypto API. MD5 and SHA-1 are fine for checksums but are broken for security uses.
How to use the Hash Generator
- Type or paste your text in the Text to hash box.
- Each algorithm updates instantly as you type, shown in lowercase hexadecimal.
- Press Copy next to the hash you need.
- To verify a checksum, hash the same input and compare the two values character for character.
Formula
digest = H(UTF-8 bytes of the text), shown as hexadecimalThe text is encoded as UTF-8 and hashed with the browser's Web Crypto API (crypto.subtle.digest). Output lengths: SHA-1 160 bits (40 hex characters), SHA-256 256 bits (64), SHA-384 384 bits (96) and SHA-512 512 bits (128). Nothing is sent to a server.
Choosing an algorithm
- SHA-256: the default choice for integrity checks, signatures and APIs
- SHA-384 and SHA-512: longer SHA-2 digests for higher security margins
- SHA-1: legacy only; practical collisions exist, so do not use it for security
- MD5: broken for security; acceptable only as a quick non-security checksum
Hashing is not encryption
Encryption can be reversed with a key; a hash cannot be reversed at all. To store passwords, use a slow, salted password hashing function such as Argon2, bcrypt or scrypt rather than a single fast SHA hash.
Hash Generator questions
Which hash algorithm should I use?
Use SHA-256 for almost everything: file checksums, data integrity and API signatures. Use SHA-384 or SHA-512 when a standard asks for them. Avoid MD5 and SHA-1 for anything security-related, because both have known collision attacks. SHA-256 is supported by every major language and operating system, which makes its checksums easy to verify anywhere. If a project already publishes SHA-512 sums, use the same algorithm.
Can I reverse a hash to get the original text?
No. Cryptographic hashes are one-way functions, so there is no key or formula that recovers the input. Short or common inputs can still be guessed by hashing candidate words and comparing the results, which is why passwords need salted, slow hashing.
Why do two similar texts have completely different hashes?
Good hash functions have the avalanche property: changing one bit of the input changes about half of the output bits. That makes hashes useful for detecting any change at all, even a single extra space or a different letter case.
Is MD5 still safe to use?
Not for security. Researchers can create two different inputs with the same MD5 hash in seconds, so it cannot protect passwords or prove that a file is genuine. MD5 is still acceptable for spotting accidental corruption, such as checking that a download completed.
Should I hash passwords with SHA-256?
Not on its own. SHA-256 is designed to be fast, which helps attackers try billions of guesses. Store passwords with a dedicated password hashing function, Argon2id, bcrypt or scrypt, which adds a unique salt and deliberately slows each guess. Most web frameworks include one of these functions by default.
Can I hash files with this tool?
This tool hashes text you type or paste. For files, use your operating system: sha256sum file on Linux, shasum -a 256 file on macOS, or Get-FileHash file in Windows PowerShell. Compare the output with the checksum the publisher lists. Matching values prove the file arrived unchanged.
Does the same text always give the same hash?
Yes. Hashing is deterministic, so identical input always produces an identical digest. Watch for invisible differences such as trailing spaces, line endings and letter case, which are the usual reason two hashes of the "same" text do not match. Copying text from a PDF or a web page often adds such hidden characters.