About Cryptographic Hashes
A cryptographic hash function takes an input of any length and produces a fixed-length fingerprint of that input. Change a single character, and the fingerprint changes completely. This one-way property — easy to compute forwards, effectively impossible to reverse — is the foundation for verifying file integrity, comparing large payloads without transferring them, signing software releases, and storing passwords safely.
This tool computes SHA-1, SHA-256, and SHA-512 using the browser's built-in Web Crypto API, which is the same implementation browsers use for TLS. The calculation happens locally, so whatever you paste in never leaves your machine. That matters when the input is a password, an API key, or a piece of sensitive content you want to fingerprint without exposing.
SHA-256 is the default choice for most applications today. SHA-1 is shown here because it still appears in legacy systems (Git commit IDs, older TLS certificates, some APIs), but it should never be used for new security-sensitive work — collisions have been demonstrated in practice. SHA-512 produces a longer hash and is marginally faster on 64-bit machines but offers no practical security advantage over SHA-256 for most uses.
How to Generate a Hash
- Paste or type your text into the input field.
- All three hash values (SHA-1, SHA-256, SHA-512) are computed and shown side by side as you type.
- Copy whichever hash you need using the copy button next to the output.
- To verify a hash from somewhere else, paste the original input here and compare the result character-by-character — any difference means the data changed.
Examples
Hashing a short string
Input
hello
Output
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
A single-character change produces a completely different hash
Input
Hello
Output
SHA-256: 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
Notice how capitalising the H produces a hash with nothing in common with the previous one. This is called the avalanche effect.
Common Use Cases
- Verifying that a file you downloaded matches the hash published by the author.
- Creating a short fingerprint of a large document so you can check whether it has changed without storing a copy.
- Computing webhook signatures (HMAC commonly wraps SHA-256 for this).
- Deduplicating user uploads — if two files have the same SHA-256, they are byte-identical.
- Generating idempotency keys or cache keys from a deterministic input.
Tips
- Never hash a password with plain SHA-256 for storage. Use a purpose-built password hash such as bcrypt, scrypt, or Argon2 — they include salting and deliberate slowness that defeat offline attacks.
- Hashes are deterministic: the same input always produces the same output. If you need uniqueness (a session token, a random ID), use a random generator instead.
- For file integrity checks, download the hash over a separate channel than the file itself. A hash hosted next to the file it protects can be tampered with by the same attacker.
Frequently Asked Questions
Why is SHA-1 still included if it is insecure?
Because it still appears widely in practice — Git uses it, older certificates and legacy APIs rely on it, and you sometimes need to verify one. It is included for compatibility, not recommendation.
Can I reverse a hash?
No. That is the defining property of a cryptographic hash. What you can sometimes do is guess the input and check: for a small input space (short strings, known patterns, common passwords) a brute-force or rainbow-table attack can succeed. This is why password storage uses salted, slow hashes.
Should I use SHA-256 or SHA-512?
For most applications either is fine. SHA-256 is more common and produces shorter hashes; SHA-512 is marginally faster on 64-bit hardware and produces a longer output. Pick SHA-256 unless you have a specific reason otherwise.
Is my input sent to a server?
No. Hashing is performed entirely in your browser using the Web Crypto API. Nothing you paste leaves your device.