Answer: The Hash Generator produces your output instantly from the input you provide — everything runs in your browser, free, with no signup required.
Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 hashes instantly
A hash function takes input data of any size — a single character, a paragraph, or an entire file — and produces a fixed-size output string called a digest or hash. The same input always produces the same hash, but even a tiny change creates a completely different hash: flip one bit of the input and roughly half the bits of the output change, a property called the avalanche effect. Good cryptographic hash functions are also one-way: you cannot reconstruct the input from the digest, and it is computationally infeasible to find two different inputs that produce the same hash.
This generator uses your browser's built-in Web Crypto API, which implements the same SHA algorithms used by operating systems, certificate authorities, and blockchain networks. Hashing runs locally; nothing is transmitted.
SHA-256, SHA-384, and SHA-512 are members of the SHA-2 family, designed by the NSA and published by NIST in 2001. They remain the global standard for TLS certificates, code signing, package integrity, and Bitcoin's proof-of-work (SHA-256 specifically). SHA-1, published in 1995, produces a 160-bit digest and is now deprecated for security uses — Google's 2017 SHAttered attack demonstrated practical collisions. MD5 (128-bit, from 1991) has been collision-broken since 2004 and is omitted here for that reason; it survives only in legacy checksum use.
| Algorithm | Digest length | Hex characters | Status |
|---|---|---|---|
| SHA-256 | 256 bits | 64 | Current standard, safe for all uses |
| SHA-384 | 384 bits | 96 | Standard, used in higher-security suites |
| SHA-512 | 512 bits | 128 | Standard, fast on 64-bit CPUs |
| SHA-1 | 160 bits | 40 | Deprecated — collisions demonstrated in 2017 |
| MD5 | 128 bits | 32 | Broken — collisions trivial since mid-2000s |
Password storage is deliberately not on this list. Plain fast hashes like SHA-256 are poor password hashes because modern GPUs can compute billions per second when attacking leaked databases. Passwords should be hashed with deliberately slow, salted algorithms such as bcrypt, scrypt, or Argon2.
SHA-256 is the sensible default for integrity checks, signatures, and general fingerprinting — it is fast, universally available, and unbroken. SHA-512 (or SHA-384) offers a larger margin with similar speed on 64-bit hardware and is common in certificate and TLS contexts. SHA-1 and MD5 must never be used for security decisions, but remain useful as non-adversarial checksums for legacy systems that still expect them — verifying that a file you downloaded matches a published digest is fine, but a digest an attacker could influence is not.
A digest is normally written as hexadecimal: each byte becomes two characters, so SHA-256's 32 bytes render as 64 hex characters. When comparing a file against a published checksum, the comparison must be exact — any difference at all means the inputs differ. There is no "almost matching" hash; a one-character difference in a digest means the underlying data is different, and a matching digest is strong (though for broken algorithms, not absolute) evidence the data is identical. Note that hashing is about verification, not secrecy: a hash hides nothing about small inputs, because an attacker who guesses a candidate input can simply hash it and check.
When you type into the box, the tool encodes your text as UTF-8 bytes and hashes those bytes. When you load a file, it hashes the file's raw bytes directly. That distinction matters: a text editor that saves your file with a different encoding, a byte-order mark, or Windows line endings will produce a different digest than the visually identical text you pasted, even though the content reads the same. To reproduce a published file checksum, always hash the file itself rather than pasting its contents, and confirm the published digest is for the same algorithm — a SHA-256 digest cannot be checked against a SHA-512 value.
Can a hash be reversed to reveal the original input?
No. Hashing is one-way. You cannot compute the input from the digest; you can only hash candidate inputs and compare. For small or predictable inputs like short passwords, attackers use lookup tables and brute force, which is why passwords need dedicated slow hash algorithms like bcrypt or Argon2.
Why do I get a different hash for the same text?
You almost certainly don't — identical byte-for-byte input always yields an identical digest. Hidden differences such as a trailing newline, different line endings, or whitespace changes produce a completely different hash, because the algorithm processes bytes, not visual appearance.
What's the difference between hashing and encryption?
Encryption is reversible with a key: ciphertext can be decrypted back to plaintext. Hashing is not reversible: the digest is a fixed-size fingerprint and the original cannot be recovered, even by the person who hashed it.
Is SHA-256 still secure?
Yes. No practical collision or preimage attack against SHA-2 exists. It secures TLS certificates, code signing, and Bitcoin. Its successor SHA-3 exists as an independent alternative, not because SHA-2 is broken.
Can this tool hash files as well as text?
Yes — use the Load File button. The file is read in your browser and hashed locally with the same Web Crypto algorithms; nothing is uploaded. For very large files, a command-line tool such as sha256sum will be faster.