Free Hash Generator
SHA-256, SHA-1 and SHA-512 from any text — computed locally in your browser.
Hashing turns any input into a fixed-length fingerprint. The same text always produces the same hash, and changing a single character produces a completely different one. Useful for verifying that a file or message arrived unaltered, comparing values without storing the original, and checking a download against a published checksum. This tool uses the browser’s built-in Web Crypto API, so your text is never transmitted.
How it works
Enter your text
Hashes update as you type — nothing to click.
Three algorithms at once
SHA-256, SHA-1 and SHA-512 side by side.
Click a value to copy
Each field copies to the clipboard on click.
What a hash is good for — and what it is not
A cryptographic hash is a one-way function: easy to compute, effectively impossible to reverse. That makes it useful for integrity checking. Publish the SHA-256 of a download, and anyone can verify their copy matches yours byte for byte. Change one character anywhere in the input and roughly half the output bits flip — the "avalanche effect" — so tampering is immediately visible.
What hashing is not is encryption. There is no key and no way to recover the input, which also means it is not a way to protect data you need back. And it is not by itself a safe way to store passwords: a plain SHA-256 of a password can be cracked at billions of guesses per second on consumer hardware. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2. Use this tool for integrity and comparison, not for building an authentication system.
Which algorithm to pick
SHA-256 is the sensible default. It is the current standard for checksums, digital signatures and certificate fingerprints, with no known practical weaknesses. If you have no specific reason to choose otherwise, use it.
SHA-1 is included because you will still meet it — Git object IDs, older certificates, legacy checksums. It is cryptographically broken: practical collision attacks have been demonstrated, meaning two different inputs can be engineered to produce the same hash. It remains fine for detecting accidental corruption, but must not be used where an attacker could benefit from a forgery.
SHA-512 uses 64-bit operations and is often faster than SHA-256 on 64-bit hardware despite the longer output. The extra length rarely adds practical security for checksums, but it is required by some standards and produces a distinctive 128-character hex string.
MD5 is deliberately absent. It has been thoroughly broken since 2004, collisions can be produced in seconds, and the Web Crypto API does not implement it — a reasonable decision by the browser vendors that this tool follows.