Hash Generator
Hashing runs in your browser via the Web Crypto API. Nothing is sent to a server.
…
…
…
…
The hash generator produces SHA-1, SHA-256, SHA-384 and SHA-512 digests of whatever you type, updating as you type. Hashing runs through the browser Web Crypto API, so the text never leaves the page, which matters, because people paste things into hash tools that should not be sent to a server.
How it works
A hash function maps input of any length to a fixed-length output. The same input always gives the same digest, and changing a single character changes roughly half the output bits, the avalanche effect.
- SHA-1 produces 160 bits, shown as 40 hexadecimal characters. Broken for collision resistance since 2017.
- SHA-256 produces 256 bits, or 64 hex characters. The current general-purpose default.
- SHA-384 and SHA-512 produce 96 and 128 hex characters. SHA-512 is often faster than SHA-256 on 64-bit hardware.
- Text is encoded as UTF-8 before hashing, so accented characters hash by their byte sequence rather than their codepoint.
MD5 is deliberately absent. The Web Crypto API does not implement it, because it has been considered cryptographically broken since the mid-2000s, and adding a hand-rolled implementation would present a broken algorithm as an equal option.
Examples
The empty string
Text
(nothing)
Result
SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Empty input still produces a full-length digest. This particular value is worth recognising. It appears constantly in logs and databases, and it usually means a field was empty rather than that hashing failed.
A one-character change
Text
hello then Hello
Result
SHA-256 of hello starts 2cf24dba…, of Hello starts 185f8db3…
Changing one letter from lowercase to uppercase changes the entire digest, not just part of it. That is the avalanche effect, and it is why a hash cannot be used to judge how similar two inputs are.
Frequently asked questions
Why does this hash generator not offer MD5?
Because the Web Crypto API does not implement it, and for good reason. MD5 collisions have been practical to produce since 2004. Including it would mean shipping a separate hand-written implementation and presenting a broken algorithm alongside sound ones. If you need MD5 for a legacy checksum, use a dedicated tool and know what it is for.
Is my text uploaded anywhere?
No. crypto.subtle.digest runs in your browser and the page makes no network requests while you type. You can confirm it by opening the network tab and watching it stay empty.
Can I use this to hash passwords?
No. A raw SHA digest is the wrong tool for passwords because it is fast, which is exactly what an attacker wants. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2.
Why is SHA-512 sometimes faster than SHA-256?
Because SHA-512 operates on 64-bit words while SHA-256 uses 32-bit words, so on 64-bit hardware it processes more data per operation. The larger digest is not the reason to pick it, throughput often is.