About the Hash
This hash generator computes a cryptographic digest of any text you type or paste, using the browser's native Web Crypto API (crypto.subtle.digest) rather than a third-party library. Pick one algorithm from the dropdown, SHA-1, SHA-256, SHA-384 or SHA-512, and the digest recalculates live as you edit the text, shown as a lowercase hex string.
SHA-2 family algorithms (SHA-256, SHA-384, SHA-512) are the standard choice today for checksums, file-integrity checks and any place a fixed-length fingerprint of arbitrary input is needed. SHA-1 is included for compatibility with older systems and checksums you may need to reproduce, but it is not considered secure against a determined collision attack and should not be used for anything security-sensitive.
Use it to verify that a string matches a known checksum, generate a digest to compare against a value published by a vendor, sanity-check an API payload while debugging a signature mismatch, or simply see what a given piece of text hashes to under a specific algorithm.
Because hashing happens on the exact bytes of the text you enter, UTF-8 encoded, a single invisible difference such as a trailing newline, a stray space, or a different line-ending style produces a completely different digest. That is by design: cryptographic hash functions are meant to change unpredictably with any change to the input, however small.
All of it runs locally in your browser via the Web Crypto API. The text you hash is never sent to a server or logged anywhere, which makes it safe to hash sensitive strings such as API keys or config values while debugging.
How to use it
- Type or paste the text you want to hash into the input box.
- Choose the algorithm from the dropdown: SHA-1, SHA-256, SHA-384 or SHA-512.
- Read the digest; it recalculates automatically as you type or switch algorithms.
- Compare it, character by character, against an expected value to verify integrity.
- Click copy to place the hex digest on your clipboard.
- Switch the dropdown to hash the same text with a different algorithm without retyping it.
Examples
- SHA-256 of hello: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
- SHA-1 of the same word hello: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d, shorter and no longer considered collision-resistant.
- SHA-512 of invoker.tools: ddf13e8bd2ad868948d1b9f0a4e500ea3e7b66e25235de158f0714d78daa90068fb72847535a5e898751a829a7c142b6c12f2d8a86a3cf9e7bbd607289692e7f, a 128-character hex digest.
- SHA-256 of an empty input: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, a known baseline to confirm the tool produces standard digests.
- Paste a config value with and without a trailing newline and watch the SHA-256 digest change completely between the two, even though the visible text looks identical.
Digest lengths by algorithm
- SHA-1: 160-bit digest, 40 hex characters, compatibility only.
- SHA-256: 256-bit digest, 64 hex characters, the common default today.
- SHA-384: 384-bit digest, 96 hex characters.
- SHA-512: 512-bit digest, 128 hex characters, often faster than SHA-256 on 64-bit hardware despite the longer output.
SHA-1 versus SHA-2: why it matters
SHA-1 was deprecated for security purposes after practical collision attacks, such as the 2017 SHAttered demonstration, showed that two different inputs could be crafted to produce the same digest. It remains in this tool for legacy checksums and interoperability with older systems, but any new certificate, signature or password-adjacent use should use SHA-256 or a longer SHA-2 variant instead.
Common hashing mistakes
- Comparing a hash generated here against one from a tool that trims trailing whitespace or normalizes line endings first; the digests will differ even though the visible text matches.
- Expecting this tool to hash a file directly. It hashes the text you paste, so a binary file needs to be converted to a compatible text representation first, or hashed with a command-line tool instead.
- Using SHA-1 for anything beyond a legacy checksum, given the known practical collision attacks against it.
- Assuming a hash function encrypts data. A digest cannot be reversed back into the original text; it can only be compared against another digest.
- Expecting all four algorithms to display at once. The algorithm is selected per calculation; switching the dropdown replaces the shown digest rather than adding to it.
Frequently asked questions
What hash algorithms are supported?
The tool computes SHA-1, SHA-256, SHA-384 or SHA-512 digests of the text you enter, one algorithm at a time, selected from a dropdown, using the browser's Web Crypto API.
Is my text sent to a server?
No. Hashing runs entirely in your browser via the Web Crypto API, so the text you enter is never uploaded or stored anywhere.
What is the difference between SHA-256 and SHA-512?
Both belong to the SHA-2 family but produce different digest lengths: SHA-256 outputs 256 bits (64 hex characters) and SHA-512 outputs 512 bits (128 hex characters). SHA-512 is longer and uses 64-bit internal operations; both are considered secure.
Should I still use SHA-1?
SHA-1 is offered for compatibility and legacy checksums, but it is no longer considered secure against collision attacks. Prefer SHA-256 or a longer SHA-2 variant for anything security-sensitive.
Can I hash a file with this tool?
This tool hashes text input. To check a file, paste its text content if it is text-based, or use a command-line tool such as sha256sum for binaries, since the digests here are computed from the text you provide.
Why might my hash differ from another tool's output?
Differences usually come from hidden characters, trailing newlines, or text encoding. The Web Crypto API hashes the exact bytes of your input, so make sure the input matches precisely, including whitespace.
Is SHA-256 the same as the password hashing bcrypt or Argon2 use?
No. SHA-256 is a fast general-purpose digest, meant to be computed quickly, which makes it unsuitable for storing passwords on its own. Password storage needs a slow, salted algorithm such as bcrypt, scrypt or Argon2, precisely because those resist brute-force attempts far better than a fast hash like SHA-256.
Does the tool show all four hash types at once?
No. One algorithm is computed at a time, chosen from the dropdown, and it recalculates live as you type. Switch the dropdown to see the same text under a different algorithm.
What is the difference between hashing and encryption?
Hashing is one-way: a digest cannot be turned back into the original text, and there is no key involved. Encryption is reversible with the right key. Use hashing for integrity checks, encryption for confidentiality.
Which SHA algorithm should I use by default?
SHA-256 is the common default. It balances a manageable 64-character digest with strong, currently unbroken security, and is what most checksums and signatures published today use.