Hash Generator
SHA-1, SHA-256, SHA-384 and SHA-512 of any text, live as you type.
Runs entirely in your browser — nothing you paste is uploaded.
About Hash Generator
A cryptographic hash reduces any input to a fixed-size fingerprint: change one bit of input and roughly half the output bits change. That's what makes hashes useful for verifying that a file arrived intact, that two blobs are identical without comparing them byte by byte, or that a value hasn't been tampered with.
Four algorithms, computed live as you type via the Web Crypto API — the browser's native implementation, not a JavaScript reimplementation. SHA-256 is the sensible default. SHA-384 and SHA-512 are its wider siblings, and are actually faster than SHA-256 on 64-bit hardware. SHA-1 is included because you'll still meet it in Git, in legacy TLS certificates and in old APIs, not because you should choose it.
SHA-1 has been practically broken since 2017, when a collision was demonstrated for a realistic cost. Do not use it for signatures, certificates or anything where an attacker benefits from two inputs hashing the same. Its remaining legitimate use is as a non-adversarial content identifier, which is what Git uses it for.
The critical thing these hashes are not for is passwords. A general-purpose hash is designed to be fast, and fast is exactly wrong for a password — it means a GPU can test billions of candidates a second. Passwords need a deliberately slow, salted function like bcrypt, scrypt or Argon2.
Frequently asked
›Can a hash be reversed?
Not by inverting it — hashes discard information. But a short or common input can be found by guessing: rainbow tables and dictionary attacks cover every plausible password. 'Irreversible' means 'no shortcut exists', not 'unguessable'.
›Should I hash passwords with SHA-256?
No. SHA-256 is built to be fast, which is the opposite of what password storage needs. Use bcrypt, scrypt or Argon2 — deliberately slow, salted functions with a tunable cost factor. The password tool here does bcrypt.
›Is SHA-1 still safe?
Not for anything adversarial. A practical collision was published in 2017 and the cost has only fallen since. It remains acceptable as a content identifier where nobody benefits from forging a match, which is why Git still uses it — but never for signatures.
›Why is SHA-512 sometimes faster than SHA-256?
SHA-512 operates on 64-bit words and SHA-256 on 32-bit ones, so on 64-bit hardware SHA-512 does more work per instruction. It's typically 20–40% faster per byte despite producing a longer digest.
›Are MD5 and CRC32 included?
No. The Web Crypto API deliberately doesn't implement MD5, and adding a JavaScript version would mean shipping a broken algorithm on a page that tells you not to use it. CRC32 is a checksum, not a hash — it detects accidental corruption and nothing more.