hash generator
The browser's own Web Crypto, and the text stays in this tab.
The short answer
A hash is a fixed-length fingerprint of an input, and it only goes one way: nothing can turn a digest back into the text it came from. The same input always gives the same digest, which is what makes it useful for checking that a file arrived intact.
SHA-256, SHA-384, SHA-512 and SHA-1, computed as you type. Useful for checking a checksum, and useless for hiding anything, which is worth knowing before you rely on it.
The formula
text → UTF-8 bytes → digest → hex, via the browser's Web Crypto
Worked examples
- SHA-256
- 64 hex characters, 256 bits
- SHA-512
- 128 hex characters, 512 bits
- SHA-1
- 40 hex characters, and broken
Reference table
| Algorithm | Digest length | Safe for signatures? |
|---|---|---|
| SHA-1 | 160 bits | No, collisions are practical |
| SHA-256 | 256 bits | Yes |
| SHA-384 | 384 bits | Yes |
| SHA-512 | 512 bits | Yes |
How to use it
- 01Paste the textThe digest updates as you type. Nothing is sent anywhere.
- 02Choose an algorithmSHA-256 unless something specific asks for another.
Also searched for
Searches that land here include hash generator, sha256 generator, sha256 hash online, checksum generator and sha1 hash.
What a hash is for
A fingerprint, not a lockbox
Feed the same bytes in and you always get the same digest; change one bit and the digest changes completely. That makes it perfect for answering "did this arrive intact?" and useless for answering "what was this?". Both properties come from the same design, which is why treating a hash as encryption is such a common and such a serious mistake.
Length is not security
SHA-512 produces a longer digest than SHA-256 and is not meaningfully harder to attack: 256 bits is already far beyond reach. On 64-bit hardware SHA-512 is often faster, which is the real reason to pick it. Choose based on what the other end expects, not on the bigger number.
Where you will actually use this
Verifying a downloaded file against a published checksum. Checking that two files with different names hold the same content. Generating a stable cache key from a string. Comparing a value to a stored digest without storing the value itself, as long as the value was not something guessable.
Questions people ask
Can a hash be turned back into the text?
Not by any calculation, because a hash throws information away: any length of input becomes the same length of output. What can be done is guessing — hashing millions of candidate inputs and comparing. That is why hashing a common word or a short password protects it from nobody.
Should I hash passwords with SHA-256?
No. SHA-256 is built to be fast, which is exactly wrong for passwords: a GPU will try billions of candidates a second against it. Password storage wants a deliberately slow algorithm with a salt and a work factor, such as Argon2, scrypt or bcrypt. Use SHA-256 for integrity, not for secrets.
Why offer SHA-1 at all if it is broken?
Because old checksums exist and sometimes have to be verified. Collisions against SHA-1 have been demonstrated since 2017, so it must never be used for a signature or anything security-relevant. Checking that a decade-old download matches its published SHA-1 is a legitimate use, and it is the only one.