Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-512 hashes instantly.
About the Hash Generator
The Hash Generator computes cryptographic hashes using the SHA family of algorithms (SHA-1, SHA-256, SHA-512) via the browser's native crypto.subtle API. A hash is a fixed-length fingerprint of arbitrary input data: feed in any text or file, get out a deterministic 40-character (SHA-1), 64-character (SHA-256), or 128-character (SHA-512) hex string. Change one bit of the input and the entire output changes unpredictably — this is the avalanche property that makes hashes useful for integrity verification.
Hashing is fundamentally different from encryption. Encryption is two-way: you can decrypt the ciphertext back to the original using a key. Hashing is one-way: there is no algorithm that takes a SHA-256 hash and recovers the original input. This irreversibility is what makes hashes safe for storing password verifiers — even if an attacker steals the hash database, they cannot reverse it to get the passwords.
SHA-256 is the current standard, recommended by NIST and used in TLS certificates, Bitcoin, Git commit IDs, and most modern authentication systems. SHA-1 is deprecated because researchers demonstrated practical collisions in 2017 (the SHAttered attack); it should no longer be used for security purposes. SHA-512 is similar to SHA-256 but produces a longer hash and is preferred for some applications (notably password hashing with proper salting and key stretching).
How It Works
The tool uses the Web Crypto API's crypto.subtle.digest() function, which runs the hash algorithm natively in the browser (often using hardware-accelerated crypto instructions). This is faster and more secure than a JavaScript implementation of the algorithm.
The input text is first encoded to UTF-8 bytes using new TextEncoder().encode(t). This step is important because the hash operates on bytes, not characters — the same text encoded as UTF-8 vs. UTF-16 vs. Latin-1 produces different hashes. UTF-8 is the universal standard for text hashing.
The digest function returns an ArrayBuffer of raw bytes. To display the hash as a hex string, the buffer is converted to a Uint8Array, each byte is converted to a two-character hex string (b.toString(16).padStart(2, '0')), and the results are joined. The padding ensures single-digit byte values (like 15 = 0x0F) are displayed as 0F rather than F, which would break the fixed-length property of the hash output.
Worked Examples
Hashing “Hello, World!” with SHA-256 produces dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a7b0f3e0fb5c5a97d0b — 64 hex characters representing 32 bytes. The same input always produces the same hash, so you can verify this against any other SHA-256 tool. Change one character (e.g., “Hello, World?”) and the entire hash changes completely — the avalanche property in action.
Hashing the same text with SHA-1 produces 907d14fb3af2b0d4f18c2d46abe8aedce0a0d76d (40 hex chars, 20 bytes). With SHA-512, the output is 374d794a95cdcfd8b35993185fef9ba368f160d8daf432d08ba50210d2f3a6f8cdfded1f6a8c5e783b0c9e4d4d04d410feeb9504181cf2b6d44e5a7e4a4c6b82 (128 hex chars, 64 bytes). Note that the hashes are completely different — each algorithm produces independent output.
For file integrity verification, hash the file contents (you would need a file hashing tool since this one accepts text), publish the hash alongside the download link, and instruct users to verify the hash after downloading. If the downloaded file's hash matches the published hash, the file has not been tampered with. This is how Linux distributions publish ISO image checksums.
When to Use This Tool
- Verifying file integrity by comparing published checksums to downloaded file hashes.
- Generating Git commit IDs (Git uses SHA-1, though it is migrating to SHA-256).
- Detecting duplicate content (identical inputs produce identical hashes).
- Implementing content-addressable storage (key data by its hash).
- Generating cache keys for memoization of expensive computations.
- Creating deterministic IDs from text input (e.g., URL shortener slugs).
- Verifying password strength by hashing common passwords and comparing (with proper salt and key stretching for real password storage).
Limitations & Disclaimer
This tool uses the Web Crypto API, which requires a secure context (HTTPS) in most browsers — it will not work over plain HTTP. It supports only SHA-1, SHA-256, and SHA-512; MD5 is intentionally omitted because it is cryptographically broken. The tool hashes text input only, not files — for file hashing, use a desktop tool or browser extension. SHA-256 and SHA-512 are not appropriate for password storage (use bcrypt, scrypt, or Argon2 with per-user salts instead). Hash collisions exist in theory but are computationally infeasible to find for SHA-256. See our disclaimer for full terms.
Frequently Asked Questions
What is the difference between hashing and encryption?
Encryption is two-way: ciphertext can be decrypted back to plaintext using a key. Hashing is one-way: there is no algorithm that recovers the input from the hash. Encryption is for confidentiality (only authorized parties can read the data); hashing is for integrity and identification (verify the data has not changed, or use the hash as a fingerprint).
Why is SHA-1 deprecated?
In 2017, researchers from Google and CWI Amsterdam demonstrated the SHAttered attack, which produced two different PDF files with the same SHA-1 hash using about 9 quintillion computations. This practical collision breaks SHA-1's security guarantees. Modern systems should use SHA-256 or SHA-3. SHA-1 remains in legacy systems (Git) but is being phased out.
Is SHA-256 safe for storing passwords?
No — not by itself. SHA-256 is fast, which is good for integrity checking but bad for password storage because attackers can try billions of guesses per second. For passwords, use a slow key-derivation function like bcrypt, scrypt, or Argon2 with a per-user salt. SHA-256 is appropriate only for verifying that downloaded files have not been corrupted.
Can I reverse a hash to get the original text?
No. Cryptographic hashes are designed to be irreversible. The only way to find the original input is to try every possible input (brute force) until you find one that produces the target hash. For SHA-256, this is computationally infeasible for any input longer than a few bytes — though short common passwords can be cracked using rainbow tables of pre-computed hashes.
Why do I get a different hash than another tool for the same input?
The most common cause is encoding differences. If the other tool hashed the input as UTF-16 or Latin-1 bytes while this tool hashes as UTF-8, the outputs will differ. Always check the encoding. Another cause is trailing newlines or invisible characters in the input that one tool includes and the other strips.
Is my text uploaded anywhere?
No. Hashing happens entirely in your browser using the native Web Crypto API. Your text — including any sensitive content like passwords or API keys — never leaves your device. This is important because hashes of common passwords can be looked up in rainbow tables.
Last updated: July 21, 2026 · Author: HT99 Tools Editorial Team · Reviewed by: HT99 Tools Editorial Team