Generate SHA-256, SHA-512, SHA-384, and SHA-1 hashes
All hashing is done locally in your browser using the Web Crypto API
The Hash Generator computes cryptographic message digests from any text you paste in, producing SHA-256, SHA-512, and SHA-1 outputs as lowercase hexadecimal strings. It runs entirely in your browser using the built-in Web Crypto API, so the same algorithms that secure TLS certificates and Git commits are applied locally to your input.
Developers reach for it to verify file integrity, generate checksums for downloads, create deterministic keys for caching, compare a computed digest against one published by a vendor, or sanity-check how a backend will hash a given string before writing code.
A cryptographic hash function maps input of any length to a fixed-size output: SHA-1 produces 160 bits (40 hex characters), SHA-256 produces 256 bits (64 hex characters), and SHA-512 produces 512 bits (128 hex characters). The functions are deterministic — the same input always yields the same digest — but designed to be one-way, so recovering the original text from a digest is computationally infeasible. For example, the SHA-256 of the empty string is always e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
This tool sends your input to the browser's SubtleCrypto interface (crypto.subtle.digest), which is the same implementation the browser uses for HTTPS. The text is UTF-8 encoded to bytes before hashing, then the resulting byte array is rendered to hex. A single changed character produces a completely different digest — the avalanche effect — which is exactly why hashes work for integrity checks and deduplication.
Note that SHA-1 is included for compatibility with legacy systems and Git object IDs, but it is no longer considered collision-resistant and should not be used for new security-sensitive work; prefer SHA-256 or SHA-512.
Yes, it is completely free. All hashing runs locally in your browser via the Web Crypto API, so your input text is never uploaded or sent to any server.
The number in the name is the digest size in bits. SHA-256 outputs 256 bits, shown as 64 hexadecimal characters, while SHA-512 outputs 512 bits, shown as 128 hex characters.
Only for compatibility with existing systems, such as reading Git object hashes or verifying legacy checksums. SHA-1 is vulnerable to collision attacks, so use SHA-256 or SHA-512 for anything security-related.
Not directly. Plain SHA-256 or SHA-512 is too fast for password storage; use a purpose-built algorithm like bcrypt, scrypt, or Argon2 with a per-user salt instead.
Hash functions exhibit the avalanche effect, where any change to the input flips roughly half the output bits. Trailing whitespace or line endings count as input bytes, so they alter the digest entirely.
The input is encoded to bytes as UTF-8 before hashing. This matches the default behavior of most backend libraries, so the digest should agree with server-side code that also uses UTF-8.
You can verify a checksum when you have the file's text content, but this tool hashes text input rather than reading binary files, so for large or binary downloads a command-line tool like sha256sum is more practical.