Hash Generator
SHA-1, SHA-256, SHA-384 and SHA-512 checksums of text or files.
About the hash generator
Computes SHA-1, SHA-256, SHA-384 and SHA-512 digests of text or of a file, using the browser's built-in Web Crypto implementation. Files are read locally and never uploaded, so you can verify a download's checksum without handing the file to anyone.
A cryptographic hash turns any input into a fixed-length fingerprint. The same input always produces the same hash; changing a single bit produces a completely different one; and the process cannot be reversed to recover the input.
Which algorithm to use
SHA-256 is the sensible default and the one to pick if you have no specific requirement. SHA-512 is equally sound and is sometimes faster on 64-bit hardware.
SHA-1 is broken and is offered here only for checking older published checksums. A practical collision was demonstrated in 2017, and it should not be used for anything security-related.
MD5 is not offered at all. Web Crypto deliberately omits it, and collisions have been trivial to produce for two decades.
One important caveat: none of these are suitable for hashing passwords. They are built to be fast, which is precisely the wrong property when an attacker is guessing billions of candidates per second. Use a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2 instead.
Frequently asked questions
What is a SHA-256 hash used for?
Verifying that data has not been altered. It backs file checksums, digital signatures, TLS certificates, Git object identifiers and blockchain transactions β anywhere you need to confirm two pieces of data are identical.
Can a hash be reversed back into the original text?
No. Hashing is one-way by design. Short or common inputs can be found by looking them up in precomputed tables, which is why passwords must be salted, but the function itself cannot be inverted.
How do I verify a downloaded file's checksum?
Load the file into the file field above and compare the SHA-256 result with the checksum published by whoever distributed it. If they match character for character, the file is intact.
Why is there no MD5 option?
The browser's Web Crypto API deliberately does not implement MD5, because it has been cryptographically broken for years. It should not be used for anything where integrity matters.
Is SHA-256 safe for storing passwords?
No. It is far too fast, letting attackers test billions of guesses per second against a stolen database. Use a purpose-built password hash such as bcrypt, scrypt or Argon2.
Is my file uploaded when I hash it?
No. The file is read into memory by your browser and hashed locally with Web Crypto. Nothing is transmitted.