Hash Generator (SHA)
Computes the SHA-1, SHA-256, SHA-384 and SHA-512 cryptographic digests of the text you enter. Uses the browser's Web Crypto API; the text is not sent to a server.
Last updated:
Digests
Enter text above; the digests appear instantly.
- SHA-256
- b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
- SHA-512
- 309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f
- SHA-384
- fdbd8e75a67f29f701a4e040385e2e23986303ea10239211af907fcbb83578b3e417cb71ce646efd0819dd8c088de1bd
- SHA-1
- 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
When this generator is the right tool
Verifying a download against a published checksum
The SHA-256 on the project's release page is the only proof that the bytes you fetched are the bytes they shipped. Computing the digest locally and comparing takes half a minute and catches corrupted mirrors and tampered artifacts alike.
Content-addressing and deduplication
Git object IDs and container image digests are hashes of content: identical bytes collapse into one identity. Understanding that property explains why a one-byte change ripples into a completely new object ID downstream.
Designing integrity checks for webhooks and APIs
Providers sign payloads so receivers can verify origin and integrity. Experimenting here with how digests behave is the first step; the pitfalls below cover where naive designs go wrong.
Worked example: one word, four digests
Type hello (lowercase, no quotes) into the box above and look at what comes back.
- The SHA-256 digest starts 2cf24dba and runs 64 hex characters, encoding 256 bits.
- The SHA-512 line is exactly twice as long: 128 hex characters for 512 bits.
- The byte counter reads 5: plain ASCII letters occupy one byte each in UTF-8.
- Add a trailing space and every digest changes beyond recognition, though the input grew by one byte.
- Delete the space and the original digests return, character for character: determinism at work.
A digest fingerprints bytes, not meaning. The same digest can be rendered as 64 hex characters or as 44 Base64 characters, and comparing a hex output against a Base64 checksum will fail even though both name the same 32 bytes. Before declaring a mismatch, make sure both sides speak the same encoding, of both the input and the digest.
Four mistakes worth avoiding
Building a MAC as sha256(secret + message)
SHA-2's internal structure allows length-extension: an attacker who knows sha256(secret + message) can compute valid digests for extended messages without the secret. This is exactly what HMAC exists to prevent; use it instead of concatenation.
Comparing digests with ordinary string equality
In security-sensitive paths, an equality check that bails at the first differing character leaks timing information about how much of the digest matched. Use a constant-time comparison such as CryptographicOperations.FixedTimeEquals in .NET.
Hashing text when you meant to hash the file
Pasting a file's contents into a text box silently normalises line endings on some platforms, and CRLF versus LF is a different byte stream with a different digest. For files, hash the raw bytes with a local tool and use this page for strings.
Reading digest length as strength
SHA-512's longer output does not automatically mean meaningfully more security for typical uses; both SHA-256 and SHA-512 are currently unbroken. The real decisions are algorithm family (avoid MD5 and SHA-1) and, for passwords, an entirely different class of slow function.
Tools commonly used alongside this one
- UUID Generator Generate cryptographically secure UUID v4 and time-ordered v7. Bulk generation and format options.
- Base64 Encoder-Decoder Encode text to Base64 or decode it back. Standard and URL-safe (base64url) variants; UTF-8 aware, in the browser.
- HTML / Entity Encoder-Decoder Encode text to HTML entities or decode it back. Escape special characters to prevent XSS; in the browser, no signup.
- HTML Viewer Paste HTML source and preview it live instantly. In a sandboxed, isolated frame; scripts are disabled for safety.
- JWT Decoder Decode the header and payload of a JSON Web Token, inspect the standard claims and expiry. The token never leaves your browser.
Frequently Asked Questions
What is the difference between SHA-256 and SHA-512?
Both belong to the SHA-2 family. SHA-256 produces a 256-bit digest (64 hex characters), SHA-512 a 512-bit digest (128 hex characters). SHA-512 is often faster on 64-bit architectures; SHA-256 is the common default thanks to its shorter output.
Why does this tool not generate MD5?
MD5 and SHA-1 are broken against collision attacks and are not recommended for security use. This tool uses the algorithms supported by the browser's native Web Crypto API — MD5 is deliberately absent from it. SHA-1 is kept only for comparison with legacy systems.
Can I use a hash to store passwords?
No. SHA is fast — which is a weakness for passwords; an attacker can try billions of guesses per second. For passwords use a deliberately slow, salted algorithm: bcrypt, scrypt or Argon2. In .NET, PBKDF2 (Rfc2898DeriveBytes) is also suitable.
Does the same input always produce the same hash?
Yes. Cryptographic hash functions are deterministic: the same byte sequence always yields the same digest. Even a single-bit change produces a completely different digest through the avalanche effect — which is why hashes are used for integrity verification.
How do I compute SHA-256 in .NET?
System.Security.Cryptography.SHA256.HashData(byte[]) returns the digest in one line. For streams use SHA256.Create() and ComputeHash. The output is a byte array; convert it to a hex string with Convert.ToHexString.