What is a hash generator?
A hash generator runs text through a cryptographic hash function and returns a fixed-length fingerprint, called a digest. The same input always gives the same digest, and changing a single character produces a completely different one. This tool computes four SHA digests at once: SHA-1, SHA-256, SHA-384 and SHA-512.
All four are part of the Secure Hash Standard, NIST FIPS 180-4. SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family. SHA-1 is the older design and is shown only for compatibility.
How to generate a hash
- Type or paste your text into the input box.
- Click Generate.
- Copy the digest you need from the output. The output has one labeled line per algorithm, so if you use Copy, trim the label before pasting the hash elsewhere.
Every byte counts. Your text is encoded as UTF-8 before hashing, nothing is trimmed, and a trailing space or line break gives a different result. An empty input box produces no output at all. (For reference, the SHA-256 of an empty string is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.)
Example: one letter changes everything
Hashing hello world gives:
SHA-1 (legacy — insecure, do not use for security): 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256: b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-384: fdbd8e75a67f29f701a4e040385e2e23986303ea10239211af907fcbb83578b3e417cb71ce646efd0819dd8c088de1bd
SHA-512: 309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f
Capitalize the first letter (Hello world) and the SHA-256 becomes 64ec88ca00b268e5ba1a35678a1b5316d212f4f366b2477232534a8aeca37f3c. Nothing about the new hash hints at how small the change was. This property, called the avalanche effect, is what makes hashes useful for spotting tampering.
The same thing explains the most common "wrong hash" report. On Linux, echo "hello world" | sha256sum hashes the text plus a newline and prints a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447. printf 'hello world' | sha256sum matches this tool.
Which algorithm should you pick?
| Algorithm | Digest size | Hex length | Status |
|---|---|---|---|
| SHA-1 | 160 bits | 40 characters | Broken for collisions; legacy use only |
| SHA-256 | 256 bits | 64 characters | Current default for checksums, signatures and APIs |
| SHA-384 | 384 bits | 96 characters | SHA-2; a truncated SHA-512 with different starting values |
| SHA-512 | 512 bits | 128 characters | SHA-2; works on 64-bit words internally |
For most purposes SHA-256 is the right choice. It's the checksum most download pages publish next to a file, and the hash inside many API signing schemes. Pick SHA-384 or SHA-512 when a specification asks for them.
SHA-1 is a different story. The SHAttered team (CWI Amsterdam and Google) published two different PDF files with the same SHA-1 hash in 2017, and NIST announced in 2022 that SHA-1 should be phased out by December 31, 2030. Use it only to compare against an existing SHA-1 value you can't change.
What a hash is not
A hash is not encryption. Encryption is reversible with a key. A hash has no key and can't be "decrypted". Websites that offer to reverse a hash are looking it up in a table of inputs that someone hashed earlier, which works only for short or common strings.
A plain SHA hash is not a safe way to store passwords. SHA-2 is designed to be fast, and fast is exactly what an attacker guessing passwords wants. Password storage needs a salted, deliberately slow function such as Argon2, scrypt or bcrypt, as NIST SP 800-63B requires for stored passwords.
A bare hash doesn't prove who sent something. Anyone can recompute a hash after changing the data. Authenticating a message needs a keyed construction such as HMAC or a digital signature.
Good uses for this tool
- Checking that a string, config value or API payload matches a hash someone gave you.
- Generating test vectors when you're writing code that calls a SHA function.
- Creating stable identifiers or cache keys from text.
- Debugging webhook signatures by hashing the exact body you received.
The hashing runs through SubtleCrypto.digest(), the browser's built-in crypto implementation, so nothing is uploaded.
Related tools
- MD5 generator: for legacy systems and checksums that still use MD5.
- Password generator: random passwords from the browser's secure random number generator.
- UUID generator: random identifiers when you don't need a value derived from input.
- Base64 encoder: reversible encoding, a different job from hashing.
Last updated