Hash Generator — SHA-256, SHA-1 & SHA-512
A hash is a unique fingerprint of any piece of text or data. You can use it to verify that a file has not been changed, check that a password matches without storing the real password, or confirm data integrity after a transfer. This tool generates SHA-256, SHA-1, and SHA-512 hashes from any text you type or paste. It runs entirely in your browser using built-in browser security functions. Nothing is ever sent to a server, so it is safe to hash sensitive text here.
Hashes will appear here as you type.
Frequently Asked Questions
What is a hash?
A hash is a fixed-length string generated from any input by a mathematical function. The same input always produces the same hash, but even a one-character change produces a completely different result. Hashes are one-way and cannot be reversed.
What is SHA-256 used for?
SHA-256 is used to verify file integrity, store passwords securely, sign digital certificates, and power blockchain systems. It is the most widely trusted hashing algorithm for modern security applications.
What is the difference between SHA-1, SHA-256, and SHA-512?
SHA-1 produces a 40-character hash but is now considered weak. SHA-256 produces a 64-character hash and is the current standard. SHA-512 produces a 128-character hash and is stronger but less commonly used in everyday applications.
Can I reverse a SHA-256 hash?
No. Hashing is a one-way function with no mathematical reverse. Attackers who obtain hashes may try billions of guesses to find a match, which is why passwords should be salted and hashed rather than hashed alone.
What is a hash used for in file downloads?
Software download pages often list an SHA-256 hash next to the download link. After downloading, you can hash the file yourself and compare the two values. If they match exactly, the file is authentic and was not tampered with during the download.
What is MD5 and is it still safe to use?
MD5 produces a 128-bit hash and was once widely used for password storage and file verification. It is now considered cryptographically broken for security purposes — collisions can be generated in seconds and rainbow table attacks crack MD5-hashed passwords quickly. Do not use MD5 for passwords or digital signatures. It is still acceptable for non-security checksums like verifying a file was not corrupted in transit.
Why do two identical strings always produce the same hash?
Hash functions are deterministic — the same input always maps to the same output. This property makes hashes useful for lookups, comparisons, and integrity checks. The security comes from the fact that the function is designed to be one-way: you cannot derive the input from the output, and changing even one character in the input produces a completely different hash.
What is a salted hash and why is it used for passwords?
A salt is a random value added to the password before hashing: hash(password + salt). This prevents rainbow table attacks (pre-computed hash databases) because even if two users have the same password, their salts differ and their hashes will be different. Modern password storage uses algorithms designed specifically for passwords, like bcrypt, Argon2, or scrypt, which handle salting automatically and are intentionally slow.
How It Works
This tool uses the browser's native crypto.subtle.digest() API to compute SHA-1, SHA-256, and SHA-512 hashes. The input is encoded to UTF-8 bytes, passed to the algorithm, and the resulting ArrayBuffer is converted to a hexadecimal string. All computation happens locally — your input never leaves your device.
Hash Algorithm Comparison
MD5 produces 32 hex characters (128 bits) — broken for security. SHA-1 produces 40 hex characters (160 bits) — deprecated. SHA-256 produces 64 hex characters (256 bits) — the current standard. SHA-512 produces 128 hex characters (512 bits) — used for highest-security applications. For any new project, use SHA-256 or SHA-512.
Avalanche Effect
Cryptographic hash functions have the avalanche property: changing a single character in the input changes roughly half of the output bits unpredictably. This means "password" and "Password" produce completely different hashes with no visual similarity. This property makes it impossible to guess the input from small changes to the output.
When to Use This
Use to verify a file checksum after downloading to confirm it was not corrupted or tampered with, to generate a test hash to compare against an API's expected signature, to hash an API key or token to store a non-reversible reference, or to check whether two strings are identical without comparing them character by character.
More Free Tools
Base64 Encoder & Decoder
Encode text to Base64 format or decode a Base64 string back to plain text.
CSS Minifier
Minify your CSS to reduce file size and speed up your website in one click.
What Is My IP Address?
See your public IP address, location, internet provider, and timezone.
URL Encoder & Decoder
Encode special characters for safe use in URLs, or decode percent-encoded URLs.