Hash Generator
Free hash generator. Create SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text using your browser’s built-in Web Crypto — nothing is uploaded.
SHA-1
—SHA-256
—SHA-384
—SHA-512
—Hashes are computed with your browser’s built-in Web Crypto API — your text never leaves your device. Note: SHA-1 is fast but no longer considered secure for cryptographic use; prefer SHA-256 or higher.
A cryptographic hash turns any input into a fixed-length fingerprint. The same input always produces the same hash, any change produces a completely different one, and the process cannot be reversed. That makes hashes the standard way to verify that a file or message has not been altered.
This tool computes SHA-1, SHA-256, SHA-384 and SHA-512 using your browser’s built-in Web Crypto implementation, entirely on your device.
How to use the Hash Generator
Enter your text
Any length. Hashes are computed instantly as you type.
Read the hashes
All four algorithms are shown at once, so you can match whichever one a checksum was published in.
Compare or copy
Paste an expected checksum alongside to compare, or copy the hash you need.
The algorithms
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 128 bits | Broken — collisions are trivial. Never use for security |
| SHA-1 | 160 bits | Broken for collisions since 2017. Legacy verification only |
| SHA-256 | 256 bits | Secure. The current default for almost everything |
| SHA-384 | 384 bits | Secure. A truncated SHA-512 |
| SHA-512 | 512 bits | Secure. Often faster than SHA-256 on 64-bit hardware |
Use SHA-256 unless something specifically requires another. SHA-1 is included here because many older projects still publish SHA-1 checksums.
What makes a hash function cryptographic
- Deterministic — the same input always produces the same output.
- Fast to compute in one direction.
- Preimage resistant — given a hash, you cannot find an input that produces it.
- Collision resistant — you cannot find two different inputs with the same hash.
- Avalanche effect — changing one bit of input changes about half the output bits, so similar inputs produce completely unrelated hashes.
Verifying a downloaded file
Software projects publish a SHA-256 checksum alongside their downloads so you can confirm the file arrived intact and unmodified. If the hash you compute matches the published one, the file is byte-identical to what the publisher released.
On the command line: sha256sum file.iso on Linux, shasum -a 256 file.iso on macOS, or Get-FileHash file.iso -Algorithm SHA256 in PowerShell.
A checksum published on the same server as the download only proves the transfer was not corrupted. Real assurance requires the checksum to come from an independent channel or be signed with GPG.
Never hash passwords with SHA
This is the most consequential misuse of hash functions. SHA-256 is designed to be fast, which is exactly wrong for passwords — modern GPUs compute billions of SHA-256 hashes per second, so a stolen database of SHA-256 password hashes falls quickly to a dictionary attack.
Password storage requires a deliberately slow algorithm with a per-user salt: bcrypt, scrypt or Argon2, with Argon2id the current recommendation. These are tunable to take a fraction of a second per hash, which is unnoticeable at login and catastrophic for an attacker trying billions of guesses.
Other uses
- Data integrity — detecting corruption in storage and transfer.
- Digital signatures — the document is hashed and the hash is signed, rather than the whole document.
- Git — every commit is identified by a hash of its content, which is what makes history tamper-evident.
- Blockchains — blocks reference the hash of the previous block, so altering history invalidates everything after it.
- Deduplication — identical files produce identical hashes, so storage systems keep one copy.
- HMAC — a hash combined with a secret key, used to authenticate API requests and webhooks.
Frequently asked questions
Can a hash be reversed?
No. Hashing is one-way by design. Short or common inputs can be found by brute force or rainbow table lookup, but the function itself cannot be inverted.
Which hash algorithm should I use?
SHA-256 for almost everything. SHA-512 is a fine alternative and is often faster on 64-bit systems. Avoid MD5 and SHA-1 for anything security-related.
Why is SHA-1 considered broken?
Researchers demonstrated a practical collision in 2017 — two different files with the same SHA-1 hash. That defeats its use for signatures and integrity guarantees, though it remains adequate for non-adversarial checksums.
Can I use SHA-256 to store passwords?
No. It is far too fast — GPUs compute billions per second. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted per user.
What is a salt?
A unique random value added to each password before hashing, so identical passwords produce different hashes. It defeats precomputed rainbow tables and prevents an attacker from seeing which users share a password.
Do two different inputs ever give the same hash?
A collision is mathematically inevitable given infinite inputs and finite outputs, but for SHA-256 finding one is computationally infeasible. For MD5 and SHA-1, it is not.
Is my text sent to a server?
No. Hashing uses your browser’s built-in Web Crypto API locally, so nothing is transmitted.
Why does the same text always give the same hash?
Because hash functions are deterministic — that property is what makes them useful for verification. Two people hashing the same file anywhere in the world get identical results.
100% private. Files are processed on your device and never uploaded.
Instant results. No upload queue. Processing time depends on your device.
Free forever. No signup, no watermark, no paid tier.
Works everywhere. Use a modern browser on your phone or computer.
Read more about this
Related tools
Hash Generator is one of all the free tools on ToolNest. No account or subscription needed — anywhere in the world.