What is a hash and how does it work?

A cryptographic hash function takes an input of any length and produces a fixed-length output (the hash or digest). It is deterministic - the same input always produces the same hash - and one-way: you cannot reconstruct the original input from the hash. Even a tiny change in the input completely changes the hash, making them useful for verifying data integrity.

What is the difference between SHA-1, SHA-256, and SHA-512?

All three are members of the SHA (Secure Hash Algorithm) family. SHA-1 produces a 160-bit (40-character hex) digest and is now considered weak for security purposes. SHA-256 produces a 256-bit (64-character hex) digest and is the current standard for most applications. SHA-512 produces a 512-bit (128-character hex) digest and offers even stronger security - useful for high-security systems and on 64-bit CPUs it can be faster than SHA-256.

Which algorithm should I choose?

For most use cases, choose SHA-256. It is the modern default with strong security and broad compatibility. Choose SHA-512 if you want a longer digest or are working in high-security contexts. Use SHA-1 only for legacy interoperability, not for new security-sensitive systems.

Is hashing the same as encryption?

No. Encryption is reversible - you can decrypt ciphertext back to plaintext with the right key. Hashing is a one-way function with no decryption step. Hashes are used for verification (did this file change?), password storage (store the hash, not the password), and digital signatures. Encryption is used when you need to recover the original data.

Are these hashes computed on the server?

No. All hashing runs entirely in your browser using the Web Crypto API (crypto.subtle.digest). Your input text is never sent to any server. This makes the tool completely private - ideal for hashing sensitive strings like passwords you're checking or proprietary content.

Can I use hashes to verify file integrity?

Yes. Software downloads commonly include a SHA-256 or SHA-512 checksum so you can verify the downloaded file has not been tampered with. Compute the hash of the downloaded file and compare it to the published checksum. If they match, the file is authentic and unmodified. This tool works for text content - for file hashing, you would use a command-line tool like shasum or certutil.

Hash Generator

Generate SHA-1, SHA-256, and SHA-512 hashes online. Free hash generator - compute cryptographic hashes instantly.

🔒 Your text stays in your browser - nothing is sent to our servers

Input Text

Algorithm:

SHA-256 Hash

Enter text above to generate hash

How to Use

Three steps to get started

Enter your text

Type or paste any text into the input field. The hash updates automatically as you type.

Choose algorithm

Select SHA-1, SHA-256, or SHA-512. Use SHA-256 or SHA-512 for security-sensitive work. Click "Hash All" to see all results at once.

Copy the hash

Click "Copy" next to the hash you need. Use it for checksums, data verification, or any other purpose.

About This Tool

Cryptographic hashing explained

A cryptographic hash function maps input of any length to a fixed-length digest. Feed it one byte or a gigabyte and SHA-256 still returns 256 bits - 64 hexadecimal characters. The mapping is deterministic and one-way, and it avalanches: flipping a single input bit changes roughly half the output bits, which is why hello and hello. produce digests with nothing visibly in common.

This page computes SHA-1, SHA-256, and SHA-512 through the browser's Web Crypto API ( crypto.subtle.digest() ), the same vetted implementation your browser uses for TLS. Your text is UTF-8 encoded, hashed, and rendered as lowercase hex.

Which hash algorithm should I use?

The honest answer depends entirely on whether an attacker is in your threat model:

SHA-256 (64 hex chars): The sane default. It secures TLS certificates, Git object addressing in newer repositories, and Bitcoin's proof-of-work. Pick this unless you have a specific reason not to.
SHA-512 (128 hex chars): Same construction with 64-bit words, so on modern 64-bit CPUs it often hashes bulk data faster than SHA-256 despite the longer digest.
SHA-1 (40 hex chars): Cryptographically broken. Google's 2017 SHAttered attack produced two different PDFs sharing one SHA-1 digest. Use it for legacy interoperability, never to make a trust decision.
MD5: Deliberately not offered here. Collisions have been trivial since 2004. It survives as a non-adversarial checksum, but not for anything an attacker touches.

Do not use these to store passwords

This is the most consequential misuse of SHA hashes. The SHA family is designed to be fast - commodity hardware computes billions of SHA-256 digests per second, which is exactly what an attacker holding a stolen database wants. Password storage needs the opposite: a deliberately slow, salted, memory-hard function. Use Argon2id, bcrypt, or PBKDF2 with a high iteration count and a unique per-user salt. A bare SHA-256(password) falls to a GPU cracking rig in minutes.

What SHA hashes are good for: verifying a download against a published checksum, deduplicating content by digest, building cache keys from request parameters, and signing, where you hash the message and sign the digest rather than the whole document.

Because crypto.subtle lives in your browser, whatever you type is hashed on your own machine and never transmitted. For files, reach for a local shasum -a 256 instead - this page accepts text only.

FAQ

Frequently Asked Questions

Related Tools