What next?
A hash checks integrity. It is not encryption and not encoding.
How to use this tool
- Paste the text to hash.
- Pick the algorithm (SHA-1, SHA-256, SHA-384 or SHA-512).
- Copy the generated hash.
What your result means
A hash is a fixed-length fingerprint of your input, not a reversible encoding. SHA-256 always returns 64 hexadecimal characters whether you hashed one letter or a whole book, and changing a single character of the input changes roughly half the output bits. That is the property that makes hashes useful for checking that a file or message arrived intact.
What a matching hash proves is integrity, not authenticity or secrecy. Identical hashes mean identical input; different hashes mean the input changed somewhere. It tells you nothing about who produced the data. Note also that SHA-1 is included here for checking legacy checksums only — it is broken for security purposes, and anything protecting real data should use SHA-256 or stronger.
Why this one is different
Every supported algorithm is digested from the same text at once, so a checksum can be matched without knowing in advance which one produced it. The line under the result counts characters against UTF-8 bytes, and a note fires when the text ends in whitespace — the usual reason two digests of apparently identical text refuse to agree.
Digest lengths at a glance
| Algorithm | Bits | Hex characters | Where you meet it |
|---|---|---|---|
| SHA-1 | 160 | 40 | Git object IDs, legacy download checksums |
| SHA-256 | 256 | 64 | The default for file integrity, certificates, signatures |
| SHA-384 | 384 | 96 | TLS cipher suites, subresource integrity attributes |
| SHA-512 | 512 | 128 | Large-archive checksums, password KDFs |
Length alone identifies the algorithm: a 40-character sum is SHA-1, a 64-character sum is SHA-256. If a published checksum is 32 characters it is MD5, which this tool deliberately does not produce.
The fingerprint you can't reverse
A hash turns any input — a word or a whole file — into a fixed-length string. Change a single character and the output changes completely, yet the same input always produces the same hash. That makes hashes perfect for verifying integrity and fingerprinting data.
Crucially, hashing is one-way: you can't run it backwards to recover the original. Note that SHA-1 is now considered weak for security — prefer SHA-256 or above when it matters.
Related tools
What a hash is for
A cryptographic hash turns any input, of any length, into a fixed-length fingerprint — 256 bits for SHA-256. The same input always produces the same output, a single changed bit produces a completely different output, and the function cannot practically be run backwards. That combination makes hashes useful for verifying that a file has not changed, for comparing values without storing them, and for digital signatures. It makes them useless for storing data you need to get back.
Worked example
SHA-256 of the single word hello:
SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e
Change one character — Hello with a capital H — and the digest shares no recognisable pattern with the one above. That is the avalanche effect, and it is why a hash can be used to detect any change to a file, however small. The output is 64 hex characters no matter how long the input is.
Frequently asked questions
Can a hash be reversed?＋
Not by computation. But a short or predictable input can be found by brute force or by looking it up in a precomputed table — which is why passwords must never be stored as a plain hash. Use a purpose-built password hash such as bcrypt, scrypt or Argon2, with a unique salt per user.
Is SHA-1 still safe to use?＋
Not for security. Practical collision attacks exist against SHA-1, and against the older MD5 — two different inputs can be constructed that share a hash. They remain acceptable as fast non-security checksums, but anything involving trust should use SHA-256 or better.
Does my input get uploaded anywhere?＋
No. Hashing runs entirely in your browser using the Web Crypto API. Nothing you paste leaves your device.
Which algorithm should I use today?＋
SHA-256 for general integrity checking and digital signatures. For storing passwords, use a deliberately slow function such as bcrypt, scrypt or Argon2 rather than any general-purpose hash.
What is a salt and why does it matter?＋
A salt is a unique random value added to each input before hashing. It ensures two identical passwords produce different hashes, which defeats precomputed rainbow tables.
How do I verify a downloaded file?＋
Hash the file you downloaded and compare it character for character with the checksum the publisher lists. A single differing character means the file is not the one that was published.
Further reading
Assumptions & limitations
The digests are computed exactly as specified. Choosing the right function is the part the tool cannot do for you:
- SHA-1 is included for checking legacy checksums only. It is broken for any security purpose, as is the older MD5 this tool deliberately does not offer.
- A general-purpose hash is the wrong tool for storing passwords, which need a deliberately slow function such as bcrypt, scrypt or Argon2 with a per-user salt.
- Hashing is one-way but not secret: a short or predictable input can be recovered by guessing.
- Text is hashed as UTF-8. A trailing newline or a different line ending changes the digest completely, which is the usual reason two checksums disagree.