SHA Hash Generator

Type or paste any text and get its SHA-1, SHA-256, SHA-384 and SHA-512 hashes at once, as lowercase hex — computed by your browser's WebCrypto engine.

sha-hash · runs locally

How this hash generator works

Your text is encoded as UTF-8 bytes and fed to crypto.subtle.digest, the browser’s native WebCrypto implementation of the SHA family. All four digests — SHA-1 (160 bits), SHA-256 and SHA-384 (the SHA-2 family), and SHA-512 — are computed in one go and shown as lowercase hex, the format used by sha256sum, Git, and virtually every checksum you will meet. Because the hashing engine is native code, it is fast and exactly matches what OpenSSL or your language’s standard library produces for the same input. Nothing you type leaves the browser.

A note on the missing algorithm: MD5 is omitted on purpose. It is collision-broken, and WebCrypto refuses to implement it — a rare case of the platform making the secure choice for you. If a legacy system hands you an MD5 checksum, treat it as an integrity hint, never as a security guarantee.

Choosing an algorithm

  • SHA-256 — the default for new work: checksums, signatures, content addressing.
  • SHA-512 — same family, faster on 64-bit CPUs for large inputs.
  • SHA-1 — legacy only; collisions have been demonstrated, so verify old checksums but do not build on it.

Common uses

Compare a downloaded file’s published checksum, generate a stable cache key or ETag, or verify that two pieces of text are byte-for-byte identical without eyeballing them. Hashes also sit inside signed tokens — the signature of a JWT is an HMAC or signature over its hashed contents, which you can inspect with the JWT Decoder. Remember the hex string is a fingerprint of the exact bytes: a trailing newline or a different line ending produces a completely different hash.

Frequently asked questions

What is a hash used for?

A hash function condenses any input into a fixed-size fingerprint that changes completely if even one byte of input changes. That makes hashes ideal for verifying file downloads against a published checksum, detecting tampering, deduplicating data, and storing passwords (via slow, salted variants like bcrypt or Argon2 rather than raw SHA).

Why is MD5 not included?

Two reasons. MD5 has been cryptographically broken since 2004 — attackers can manufacture two different inputs with the same hash — so it should not be used for anything security-related. And browsers agree: the WebCrypto API this tool uses deliberately does not implement MD5, so offering it would require shipping a JavaScript reimplementation of a broken algorithm.

Can a SHA-256 hash be reversed to get the original text?

No. Hashing is one-way: infinitely many inputs map to each 256-bit output, so there is no decode operation. What attackers do instead is guess — hashing billions of candidate inputs and comparing results. That works against short or common inputs, which is why password storage adds salts and deliberately slow hashing.

What is the difference between hashing and encryption?

Encryption is reversible by design: anyone with the key can recover the original data. Hashing is deliberately irreversible and uses no key — it produces a fingerprint, not a ciphertext. Use encryption when you need the data back, and hashing when you only need to verify or compare it.

Base64 Encode / Decode

Encode text to Base64 or decode Base64 back to text. Full UTF-8 support.

Open tool →

UUID Generator

Generate random UUID v4 identifiers — one or hundreds at a time, cryptographically random.

Open tool →

JWT Decoder

Decode a JSON Web Token's header and payload and check its expiry — locally.

Open tool →