Hash Generator
SHA-1, SHA-256, SHA-384 and SHA-512 — computed in your browser.
Runs in your browser — nothing is uploaded
What a hash is
A cryptographic hash function turns input of any length into a fixed-length fingerprint, shown here as hexadecimal. The same input always gives the same digest, any change to the input changes the digest completely, and there is no practical way to work back from the digest to the input.
Hashes are used to check that a download or file has not been altered, to build cache keys and content addresses, to deduplicate data, and as the building block of signatures and HMACs.
Choosing an algorithm
SHA-256 is the sensible default and is used throughout TLS certificates, package-manager checksums and code signing. SHA-384 and SHA-512 produce longer digests from the same SHA-2 family. SHA-1 is broken for collision resistance and should only be used to match existing systems that still require it, such as Git object IDs.
Digests are computed over the UTF-8 bytes of your text by the browser's Web Crypto API, so results match sha256sum, OpenSSL and the hashing functions in most languages for the same text. Watch for a trailing newline: echo adds one, so use echo -n to compare.
Hashes are not for storing passwords
Fast hashes like SHA-256 are the wrong tool for passwords, because attackers can try billions of guesses per second. Store passwords with a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2. To prove a message came from someone holding a shared key, use an HMAC rather than a plain hash.
Examples
Input
helloOutput
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824Input
helloOutput
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434dInput
Output
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855How to use
- Paste your text.
- Choose an algorithm.
- Copy the hex digest.
FAQ
Where is the hashing done?
Entirely in your browser via the Web Crypto API — your input never leaves your device.
Can a hash be reversed or decrypted?
No. Hashing is one-way. 'Reverse lookup' sites only work by looking up common inputs they have already hashed, which is why short or common inputs are easy to guess.
Why doesn't my result match the command line?
Usually a trailing newline or different text encoding. echo 'hello' | sha256sum hashes 'hello' plus a newline; use echo -n 'hello' | sha256sum to match.