Hash Generator
Create SHA-256, SHA-1, SHA-384 and SHA-512 hashes of text or a file, and check a download against its published checksum.
SHA-1 and SHA-2 (FIPS 180-4) via the Web Crypto API ยท By Stuart Mathieson · Updated October 2026
Hashes
Everything runs in your browser - nothing you enter is sent to a server. Files are read on your device and never uploaded.
What is a hash?
A cryptographic hash function turns any input - a word, a document, a 4 GB file - into a short, fixed-length fingerprint. The same input always gives the same hash, but change a single character and the hash changes completely:
| Input | SHA-256 |
|---|---|
abc | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
abd | a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9 |
| (empty) | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
Hashes are one-way: you can't work back from a hash to the input. That makes them useful for checking that a file hasn't been changed or corrupted, for digital signatures, and inside many security protocols.
The algorithms
| Algorithm | Hash length | Status |
|---|---|---|
| SHA-1 | 160 bits (40 hex digits) | Broken for security - collisions have been found. Fine for non-security checks. |
| SHA-256 | 256 bits (64 hex digits) | Secure; the most widely used |
| SHA-384 | 384 bits (96 hex digits) | Secure |
| SHA-512 | 512 bits (128 hex digits) | Secure; the longest output |
SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family, defined by the US National Institute of Standards and Technology in FIPS 180-4. NIST announced in 2022 that SHA-1 should be phased out by the end of 2030. Text is hashed as UTF-8 bytes, as most tools do.
Checking a download
- Copy the SHA-256 checksum from the download page.
- Choose the downloaded file above - it is hashed on your device, not uploaded.
- Paste the checksum into Compare with an expected hash. A match means the file is exactly what the publisher hashed.
A checksum only proves the file matches the published hash. If an attacker could change the download, they may be able to change the checksum on the same page too, so the strongest checks use a signed checksum or a hash published somewhere else.
Don't use these hashes for passwords
SHA hashes are designed to be fast, which helps attackers try billions of guesses a second. Passwords should be stored with a slow, salted password-hashing function such as Argon2id, scrypt or bcrypt, as the OWASP Password Storage Cheat Sheet recommends. MD5 isn't offered here: browsers' built-in cryptography doesn't include it because it is long broken.
Frequently asked questions
Can a SHA-256 hash be reversed?
No - hash functions are one-way. Short or common inputs like simple passwords can still be found by guessing many inputs and comparing hashes, which is why passwords need a slow, salted hash.
Is SHA-1 still safe to use?
Not for security. Practical collisions have been demonstrated, and NIST says it should be phased out by the end of 2030. It is still fine for spotting accidental corruption, and Git historically used it to identify commits.
Why do I get a different hash than another tool?
Usually the input differs slightly - a trailing newline or space, different line endings (Windows vs Unix), or a different text encoding. This tool hashes exactly what is in the box, as UTF-8.
Is my file uploaded?
No. The file is read and hashed by your browser's Web Crypto API on your device. Nothing is sent to a server.
Sources
- FIPS 180-4: Secure Hash Standard (SHS) - National Institute of Standards and Technology
- NIST Retires SHA-1 Cryptographic Algorithm - National Institute of Standards and Technology, 2022
- Password Storage Cheat Sheet - OWASP
- SubtleCrypto: digest() method - MDN Web Docs