Stays in your browser
Hash Generator — SHA Online
Free hash generator. Compute SHA-1 / SHA-256 / SHA-384 / SHA-512 with Web Crypto.
—
Choosing a hash for the job
A hash turns any input into a fixed-length fingerprint. That property gives you integrity checks: publish a SHA-256 alongside a download, and a user can prove the file arrived unchanged. It also gives you fast lookups, because comparing 64 hex characters is cheaper than comparing two large files.
What a hash does not do is hide small inputs. Passwords are the important case, because a GPU can try billions of guesses per second against a fast hash, and precomputed tables defeat unsalted ones entirely. Password storage needs a deliberately slow, memory-hard function such as Argon2id or bcrypt, with a unique salt per user, and never a plain SHA or MD5.
When you compare digests, compare them in constant time. A naive string comparison stops at the first differing character and leaks information about how much of a guess was correct. For integrity checks over the public internet this rarely matters, but for anything authentication-related it does.
FAQ
- What are hashes for?
- Integrity checks and fingerprints — not encryption.
- Can I decrypt a hash?
- No. Hashing is one-way.
- Does text leave the browser?
- No. SubtleCrypto runs locally.
- SHA-256, SHA-1, or MD5: which should I use?
- SHA-256 for anything new. MD5 and SHA-1 are broken for collision resistance, which means an attacker can craft a second input with the same digest, so they must not be used for signatures or certificates. They still appear in legacy checksums, and that is the only place they are acceptable.
- How should I hash a password?
- Not with SHA-256. Use a password hashing function such as Argon2id, scrypt, or bcrypt, which are intentionally slow and tunable, and give every password its own random salt. Fast general-purpose hashes make offline cracking cheap, no matter how long the password is.
- Why does the same input always produce the same hash?
- Determinism is the point: a hash is a pure function of its input, so systems can compare fingerprints without storing the original. That determinism is also why salts exist, since it lets an attacker reuse one cracking effort across every user who picked the same password.