Hash Generator (SHA-256, SHA-1, SHA-512)
Generate SHA-256, SHA-1, and SHA-512 hashes from any text in your browser.
Turn any text into a SHA-256, SHA-1, or SHA-512 hash — a fixed-length fingerprint that changes completely if even one character of the input changes. Hashing runs locally through the Web Crypto API, so your input never leaves the browser.
What hashing is for
A cryptographic hash produces a fixed-size output from any input. It's one-way — you can't reverse a hash back to the original — and deterministic, so the same input always gives the same hash. That makes hashes perfect for integrity checks (confirming a file downloaded without corruption), fingerprints (spotting duplicate content), and as building blocks inside signatures and password storage schemes.
Which algorithm to pick
SHA-256 is the sensible default: widely supported and secure for general use. SHA-512 produces a longer digest and can be faster on 64-bit hardware. SHA-1 is included for compatibility with older systems, but it's considered broken for security purposes — don't rely on it where collisions matter.
Verifying a download with a checksum
Software projects often publish a SHA-256 checksum next to a download. After downloading, you hash the file yourself and compare: if the two strings match character for character, the file arrived intact and unaltered; if even one bit changed, the hash is completely different. This tool hashes text rather than files, but the principle is the same — a hash is a compact fingerprint that makes tampering or corruption obvious.
Why you don't store passwords as plain hashes
Hashing is a building block for password storage, but a raw SHA-256 of a password isn't enough on its own. Real systems add a unique random salt per user and use a deliberately slow, purpose-built algorithm (such as bcrypt, scrypt, or Argon2) to make large-scale guessing expensive. Plain fast hashes like SHA-256 are ideal for integrity checks and fingerprints, not for protecting secrets.
Hashes verify, they don't encrypt
A hash function turns any input into a fixed-length fingerprint. Change one character of the input and the entire output changes unpredictably, which makes hashes ideal for checking that a file or message arrived intact. Download a large file, hash it, and compare against the value the publisher listed — if they match, the file wasn't corrupted or tampered with in transit. This is verification, not secrecy: a hash is a one-way street, so you cannot reverse it back into the original data.
Frequently asked questions
Can a hash be reversed?
No. Cryptographic hashes are one-way functions. You can't recover the input from the hash — you can only re-hash a guess and compare.
Should I use SHA-1?
Only for legacy compatibility. SHA-1 is no longer collision-resistant, so prefer SHA-256 or SHA-512 for anything security-related.
Is my text sent anywhere?
No. Hashing uses the browser's Web Crypto API and runs entirely on your device.
Why do two different inputs sometimes worry people about collisions?
A collision is when two inputs share a hash. For SHA-256 and SHA-512 this is computationally infeasible to find, so they remain safe. SHA-1 collisions have been demonstrated, which is why it's discouraged.
Can I use these hashes to store passwords?
Plain SHA hashes are not suitable for passwords on their own. Password storage needs a purpose-built, deliberately slow algorithm with a unique salt per user, such as bcrypt or Argon2.
Last updated: 2026-01-15