Hash Generator (SHA-1, SHA-256, SHA-384, SHA-512)

What this tool does

A cryptographic hash maps an input of any length to a fixed-length digest. The same input always produces the same digest, and a different input produces a digest that looks unrelated. This tool computes that digest with SHA-1, SHA-256, SHA-384 or SHA-512 and shows the result as hexadecimal. It is used for integrity checks, file and content fingerprints, and quick comparisons where you need to confirm two pieces of text are identical without comparing them byte by byte.

Method

The algorithms are the secure hash functions specified in FIPS 180-4. The text is encoded as UTF-8 bytes and passed to the browser’s native SubtleCrypto.digest() implementation; the returned bytes are rendered as lowercase hexadecimal. SHA-1 is included for compatibility with legacy systems only: it has known collision attacks and is not suitable for security. Use SHA-256 or stronger for anything that matters.

Example

Text	Algorithm	Hex digest
`abc`	SHA-256	`ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad`
`(empty string)`	SHA-256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`

Which hash to use

The dropdown offers SHA-1, SHA-256, SHA-384 and SHA-512. For anything new, use SHA-256 or above: SHA-1 is deprecated for security purposes because collisions have been constructed, and MD5 is broken outright. Both remain useful for non-security checksums, where the goal is to detect accidental corruption rather than deliberate tampering.

Algorithm	Digest size	Status	Use for
SHA-1	160 bits	Deprecated	Legacy compatibility, git object names
SHA-256	256 bits	Recommended	File integrity, content addressing, HMAC
SHA-384	384 bits	Recommended	Where a longer digest is required by policy
SHA-512	512 bits	Recommended	The same, and often faster than SHA-256 on 64-bit hardware

A hash proves integrity, not authenticity

Comparing a file's digest against a published value tells you the file is byte-for-byte the one that was hashed. It does not tell you who published the value. If an attacker can replace both the file and the published digest — because both come from the same server — the comparison still passes. Integrity is only meaningful when the expected value arrives over a channel the attacker does not control.

If you need to prove who produced a message, not just that it is unchanged, a plain hash is the wrong tool. You want a keyed MAC (HMAC) or a signature, both of which bind the digest to a key.

Why hashing here happens in your browser

A hash tool is often used on values that are sensitive — a password to check against a stored digest, a licence key, a token. Uploading the value to hash it would defeat the purpose of checking it privately. This tool uses the browser's WebCrypto implementation and never sends the input anywhere, which you can confirm in the network panel.

Deterministic, but not a password hash

The output is deterministic: the same input always gives the same digest, which is what makes it useful for comparison. That property is also why a fast hash is the wrong choice for storing passwords — an attacker can compute billions of candidate digests per second. Password storage needs a deliberately slow, salted function such as Argon2id or bcrypt, which this tool deliberately does not provide.

Comparing digests safely

When you compare two digests in code, use a constant-time comparison rather than string equality. An equality check that exits at the first differing byte leaks how many bytes matched, which over many attempts is enough to reconstruct a valid digest. In a browser tool that is not a concern; in a server that verifies a signature, it is.

Frequently asked questions

Which hash algorithms are supported?

SHA-1, SHA-256, SHA-384 and SHA-512, exactly as defined in FIPS 180-4. SHA-256 is the default because it is the common choice for integrity checks and file signatures.

Is my text uploaded to a server?

No. The digest is computed by the browser’s own WebCrypto SubtleCrypto API inside this page. The text never leaves your device and no network request is made.

Can I use these hashes to store passwords?

No. A single unsalted SHA hash is fast to compute, so it is trivial to brute-force or look up in a rainbow table. Password storage requires a deliberately slow, salted algorithm such as Argon2, scrypt, bcrypt or PBKDF2; a plain SHA digest is the wrong tool for that job.

What is the difference between SHA-1 and SHA-256?

SHA-1 produces a 160-bit (40 hex character) digest and has known practical collision attacks, so it is legacy and must not be used where security matters. SHA-256 produces a 256-bit (64 hex character) digest and remains suitable for integrity and signature work.

Why does the same text always give the same hash?

That is the point of a cryptographic hash: it is deterministic. The same bytes always produce the same digest, while any change to the input, even one character, produces a completely different digest.

Does the hash depend on encoding?

Yes. The text is first encoded as UTF-8, then hashed. Because a character such as an accent or an emoji can take several UTF-8 bytes, the digest is over those bytes, not over code points or an arbitrary platform encoding.

Go deeper

Longer explanations of the problems this tool solves:

Sources

FIPS 180-4, Secure Hash Standard (SHS), NIST.