Hash Generator
Compute cryptographic hashes of your text using various algorithms. All hashing is done locally in your browser.
Updated July 11, 2026
100% Private & Secure
This tool runs in your browser.
Your data is never uploaded or stored.
Hash will appear here automatically as you type...
Hash will appear here automatically as you type...
Hash will appear here automatically as you type...
Hash will appear here automatically as you type...
How to use
- 1
Enter your text.
- 2
Select the hash algorithm.
- 3
Click Generate to compute the hash.
When to use it
Verifying file or message integrity
Publish a SHA-256 of a release artifact alongside the download. Anyone can recompute the hash locally and confirm the bytes they received match the bytes you shipped — no tampering in transit.
Understanding password hashing (use a KDF, not a raw hash)
Passwords must be run through bcrypt, scrypt, or Argon2 — never plain SHA-256. But understanding the SHA family is the foundation: these KDFs chain or extend SHA internally to make brute-force expensive.
Generating content-addressed keys
Git stores every object under the SHA-1 of its content; IPFS uses a multihash of the file; cache layers often key on a hash of the request body. Same content always hashes to the same identifier.
Debugging a signature or HMAC mismatch
When two systems disagree on a signature, the first thing to verify is that both sides hash the same bytes. Comparing SHA-256 digests of the raw payload pinpoints where the bytes diverge.
How it works
What a cryptographic hash is
A hash function maps arbitrary-size input to a fixed-size digest. A cryptographic hash adds three properties: preimage resistance (you cannot reverse the digest to the input), second-preimage resistance (you cannot find a different input with the same digest), and collision resistance (you cannot find any two inputs that share a digest).
The SHA-2 family is defined by NIST FIPS 180-4; SHA-3 (Keccak) by FIPS 202. In the browser, both are available through crypto.subtle.digest().
- SHA-256 produces a 256-bit digest — 32 bytes, shown as 64 hex characters
- SHA-512 produces a 512-bit digest — 64 bytes, shown as 128 hex characters
- Same input + same algorithm = identical digest, every time, on every machine
Hex vs Base64 digest output
The raw digest is a sequence of bytes, not text. Two encodings are common: hexadecimal (each byte becomes two characters 0-9a-f) and Base64 (each three bytes become four ASCII characters).
Hex is human-readable and easy to diff — that is why sha256sum output, certificate fingerprints, and Git object IDs all use it. Base64 is ~33% shorter, which is why JWTs and many binary checksum formats prefer it. Always agree on the encoding up front: the same digest renders differently in each.
// Same SHA-256 digest of "test", two encodings:
// hex: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
// base64: n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=Why MD5 and SHA-1 are broken
Hashing is only safe while collisions remain infeasible. MD5 was broken in practice by 2008 — chosen-prefix collisions can be computed in seconds on a laptop. SHA-1 was broken by the 2017 SHAttered attack (Google/CWI), which produced two distinct PDFs with identical SHA-1 digests. In December 2022, NIST announced SHA-1 retirement by end of 2030.
For anything security-relevant — signatures, certificates, integrity checks an adversary might influence — use SHA-256 or SHA-3. MD5 and SHA-1 remain useful only for non-adversarial tasks like change detection in build systems or deduplicating cache entries.
Common mistakes & edge cases
Using SHA-256 to store passwords directly
Plain SHA-256 is far too fast — a GPU can brute-force billions per second. Use a password-specific KDF: bcrypt, scrypt, or Argon2id, with a per-user salt and an appropriate work factor.
Comparing two hashes with === and leaking timing information
String comparison short-circuits on the first differing byte, leaking information through timing. Use a constant-time compare when hashes guard secrets.
Hashing a string directly instead of its UTF-8 bytes
Hash functions operate on bytes. Different encodings of the same text hash differently. Always encode through TextEncoder (UTF-8) first, then hash the resulting ArrayBuffer.
Expecting a similar hash after "slightly" changing the input
That is the design — the avalanche effect means a one-bit change flips ~50% of output bits. If two unrelated inputs share a digest, check for a copy-paste error, not the algorithm.
Frequently Asked Questions
Is hashing the same as encryption?
Which algorithm should I use?
References & further reading
Related reading
What actually makes a password strong
Entropy, length versus complexity, and why a long random password beats a short clever one — with the math that explains it.
SHA-256, Salt, and Why a Raw Hash Fails Your Passwords
Why SHA-256 is excellent for file integrity but catastrophic for passwords — and how bcrypt, scrypt, and Argon2id fix the speed problem.