Hash Generator
Compute SHA-256, SHA-384, SHA-512 and legacy SHA-1 digests with the Web Crypto API. Runs entirely in your browser.
Compute SHA-256, SHA-384 or SHA-512 digests with the Web Crypto API. Useful for checksums and integrity checks.
SHA-256 digest
computing...
// SHA-256 of the text above is shown in the panel on the right.
// In code:
const data = new TextEncoder().encode("hello world");
const buf = await crypto.subtle.digest("SHA-256", data);
const hex = [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, "0")).join("");About the hash generator
A hash is a one-way fingerprint: the same input always gives the same digest, and the digest reveals nothing about the input. That makes hashes right for integrity checks and for comparing values without storing them.
SHA-1 is included for legacy checksums only. It has been broken for security purposes since practical collisions were demonstrated in 2017.
A single changed bit anywhere in the input flips about half the bits of the digest, with no resemblance to the original output. That avalanche is what makes a hash useful for verifying a download or a file: if one byte is wrong, the digest is unmistakably different, not nearly the same.
How to use it
- 1Paste or type the text.
- 2Choose the algorithm. SHA-256 is the sensible default.
- 3Read the digest, which updates as you type.
- 4Copy the code sample if you need it in your own project.
Worth knowing
- To verify a download, hash the file and compare against the digest the publisher lists. If they match character for character, the file arrived intact; if not, do not trust it.
- Hashing text is sensitive to invisible differences. A trailing newline or a space changes the digest, so two values that look identical can hash differently.
- These are plain digests with no salt. That is correct for checksums and integrity, and wrong for storing passwords, where a per-user salt and a slow algorithm are the point.
Questions
Should I hash passwords with SHA-256?
No. General purpose hashes are far too fast, which makes brute forcing cheap. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted.
Why is SHA-1 marked legacy?
Practical collisions were demonstrated in 2017. It is fine for non-security checksums but must not be used where forgery matters.
Is my input sent to a server?
No. Hashing uses the browser's built-in Web Crypto API, entirely locally.
What is the difference between SHA-256, 384 and 512?
The number is the digest length in bits. SHA-256 is plenty for almost everything; the longer two add margin for high-security use and are faster than you might expect on 64-bit machines.
Can I get the original text back from a hash?
No. Hashing is one-way by design. Anyone who seems to reverse one is really just looking the digest up in a table of pre-computed common inputs, which is why real password storage adds a salt.