Hash generator
Generate SHA-256, SHA-1, SHA-384 or SHA-512 hashes of text with the Web Crypto API. The hex digest updates as you type, and text is hashed as UTF-8 in your browser.
About Hash generator
The hash generator calculates a cryptographic digest of any text using the Web Crypto API built into your browser. Choose SHA-256, SHA-1, SHA-384 or SHA-512, type or paste the text, and the lowercase hexadecimal digest appears as you type, ready to compare against a published checksum or an expected value in a test.
Text is encoded as UTF-8 before hashing, like most command-line tools and programming languages, so results match sha256sum or Python’s hashlib for the same bytes. Every character counts: a trailing newline or a different line ending produces a completely different hash. MD5 is not offered.
How to use Hash generator
- Choose SHA-256, SHA-1, SHA-384 or SHA-512.
- Type or paste the text to hash, or open or drop a text file.
- Read the hex digest in the output box.
- Copy the digest or download it as a .txt file.
Features
- Supports SHA-1, SHA-256, SHA-384 and SHA-512 through the browser’s Web Crypto API.
- Outputs a lowercase hexadecimal digest of 40, 64, 96 or 128 characters, depending on the algorithm.
- Hashes the exact UTF-8 bytes of the input, including spaces and line breaks.
- Updates the digest automatically as you edit the input or change the algorithm.
- Accepts text up to 2 MB.
Common uses
- Checking a string against a SHA-256 value given in documentation or a test fixture.
- Generating an expected hash for a unit test or an API signing example.
- Comparing two long strings by their digests instead of reading them side by side.
- Creating a content fingerprint for a cache key or deduplication.
Tips
- Opened files are read as text, so this tool is reliable for text files only. To verify a downloaded binary such as an installer or disk image, use sha256sum, shasum -a 256 or certutil on your computer.
Frequently asked questions
Is SHA-1 still secure?
Not for security. A practical SHA-1 collision was demonstrated in 2017, so it should not be used for signatures, certificates or anything an attacker could tamper with. It is still acceptable for non-security uses, such as legacy checksums or matching existing identifiers like Git object IDs.
Why is MD5 not available?
MD5 is broken for security purposes and is not part of the browser’s Web Crypto API, which this tool uses. For new work, SHA-256 is the usual choice. If you must match an existing MD5 checksum, use md5sum or a similar command-line tool.
Can I use this to hash passwords?
Not for storage. Plain SHA hashes are fast to compute, which makes stored password hashes easy to brute-force. Password storage needs a slow, salted algorithm such as Argon2, bcrypt, scrypt or PBKDF2. This tool is suited to checksums, fingerprints and test values.
Why doesn’t my hash match the one from the command line?
Usually the inputs differ by invisible characters. echo adds a trailing newline, Windows files use CRLF line endings, and copied text may contain non-breaking spaces. Use echo -n or printf, and check line endings, so both tools hash exactly the same bytes.
Which SHA algorithm should I use?
SHA-256 is the common default for checksums, APIs and signatures. SHA-384 and SHA-512 produce longer digests and are often faster on 64-bit processors. Use SHA-1 only when an existing system requires it.
Can it create an HMAC?
No. An HMAC combines a secret key with the message, and this tool computes plain hashes of the input only. Hashing a key and message pasted together does not produce the same value as HMAC-SHA256.
Is my input uploaded?
Tools run in your browser. Files, text and results are not uploaded to our servers and are cleared when you leave the tool.
Your privacy comes first
Tools run in your browser. Files, text and results are not uploaded to our servers and are cleared when you leave the tool.