Hash Generator
A hash generator turns any text into a fixed-length hash value using algorithms such as SHA-1, SHA-256, SHA-384, and SHA-512. The output looks like a random string of hex characters, but it is not random. The same input text always produces the exact same hash, and changing even one character produces a completely different result. This tool runs entirely in your browser using the Web Crypto SubtleCrypto API, so the text you type never leaves your device or reaches a server. Developers use it to verify file integrity, check that a download was not corrupted, generate lookup keys, or compare two pieces of text without storing the text itself.
Quick answer
Supports SHA-1, SHA-256, SHA-384, and SHA-512, the hash algorithms built into the browser's SubtleCrypto API.
Client-side only. Hashing is one-way and not encryption.
What this tells you
- •Supports SHA-1, SHA-256, SHA-384, and SHA-512, the hash algorithms built into the browser's SubtleCrypto API.
- •Processing runs client-side in your browser, so input text is never sent to a server or logged anywhere.
- •Hashing is one-way. There is no reverse function that turns a hash back into the original text.
- •The same input always produces the same hash, and a single changed character produces a completely different output. This is called the avalanche effect.
- •Hash length depends only on the algorithm, not the input length. A one-word input and a full paragraph hashed with SHA-256 both produce a 64-character hex string.
How to Use
- 1Enter or paste the text you want to hash into the input field. This can be a password candidate, a file's text content, or any string you need a digest for.
- 2Choose a hash algorithm from the dropdown. SHA-256 is the most common general-purpose choice, while SHA-1 is included mainly for compatibility with older systems.
- 3Click Generate Hash to compute the digest. The result appears as a hex-encoded string.
- 4Copy the output using the copy button and paste it wherever you need to compare, store, or share the hash value.
- 5To check whether two pieces of text are identical without comparing them directly, hash both and compare the resulting hash strings instead.
How It Works
Formula
Digest = HASH(algorithm, UTF-8 input bytes)The tool first converts your input text into UTF-8 bytes, since hash functions operate on bytes rather than characters directly. The browser's SubtleCrypto API then runs those bytes through the selected algorithm, which processes the data in fixed-size blocks and compresses it down to a fixed-length output through a series of bitwise operations, modular additions, and compression rounds defined by the algorithm's specification. The result is converted from raw bytes into a hex-encoded string for display. SHA-1 always produces 160 bits (40 hex characters), SHA-256 produces 256 bits (64 hex characters), SHA-384 produces 384 bits (96 hex characters), and SHA-512 produces 512 bits (128 hex characters), regardless of how long or short the input text is.
Calculation note: values are processed in the order shown above, using the current input units.
Worked Examples
SHA-256 hash of 'hello'
This is the standard reference SHA-256 hash for the five-letter word hello, encoded as UTF-8 bytes before hashing. It is commonly used to sanity-check that a hashing implementation is working correctly, since this exact output is well known and reproducible across every correct SHA-256 implementation.
SHA-1 hash of 'hello'
The same input hashed with SHA-1 produces a shorter 40-character output instead of the 64-character SHA-256 output. SHA-1 is still useful for checksums and legacy compatibility, but researchers demonstrated a practical collision attack against it in 2017, so it should not be relied on for security-sensitive verification.
SHA-256 hash of 'Hello World'
Capitalizing the H and adding a space and capital W completely changes the output compared to the lowercase 'hello' example above, even though the words are related. This demonstrates the avalanche effect: small input changes produce unrelated-looking output hashes, which is exactly what makes hashing useful for detecting tampering.
SHA-512 hash of a sample password string
SHA-512 produces a 128-character hex string, the longest output of the four supported algorithms. This example is shown for illustration only. Real password storage should never use a raw SHA hash without a unique salt and a slow, purpose-built algorithm, because plain SHA-512 can be brute-forced quickly on modern hardware using precomputed tables.
SHA-384 hash of a product name
SHA-384 is a truncated variant of SHA-512 that produces a 96-character output. It offers a middle ground between SHA-256 and SHA-512 in output length and is sometimes used in TLS certificates and signing schemes that specify it directly.
SHA-256 hash of empty text
Even an empty string has a defined hash value, since the algorithm still processes the padding it adds internally before compression. This constant value is well known and shows up whenever a hash is computed on missing or blank input, which is a useful sanity check when debugging a pipeline that hashes file contents.
Hash Algorithm Output Lengths
Digest size and typical use for each supported algorithm.
| Algorithm | Output size | Hex characters | Typical use today |
|---|---|---|---|
| SHA-1 | 160 bits | 40 | Legacy checksums, git object IDs, compatibility only |
| SHA-256 | 256 bits | 64 | General-purpose integrity checks, certificates, checksums |
| SHA-384 | 384 bits | 96 | TLS certificate signing, some enterprise security tooling |
| SHA-512 | 512 bits | 128 | High-assurance integrity checks, larger digest requirements |
Output length depends only on the algorithm, never on the length of the input text.
Hashing versus encryption
Hashing and encryption solve different problems, and mixing them up is one of the most common security mistakes. Encryption is reversible: data is scrambled with a key, and the same or a related key can unscramble it back to the original. Hashing is one-way by design. There is no key, and there is no built-in operation that turns a hash back into the text that produced it. A hash generator like this one is meant for verification and comparison, not for hiding data that needs to be recovered later.
Because hashing is deterministic, the same input text always produces the same hash, which is what makes it useful for integrity checks. If a file is downloaded and its SHA-256 hash matches the hash published by the source, the file was very likely not corrupted or tampered with in transit. If even a single byte changed, the hash would come out completely different due to the avalanche effect, making tampering obvious.
SHA-1 and SHA-256 belong to the SHA family of cryptographic hash functions, but they are not equally trustworthy anymore. SHA-1 was designed in the 1990s and was widely used for years, but security researchers demonstrated a practical collision attack against it in 2017, meaning two different inputs can be crafted to produce the same hash. That breaks the guarantee that a hash uniquely represents its input, so SHA-1 should not be used for new digital signatures, TLS certificates, or any process that depends on collision resistance. SHA-256, SHA-384, and SHA-512 belong to the newer SHA-2 family and remain considered secure against known collision attacks as of this writing.
A separate and equally important point is that no plain SHA algorithm, including SHA-256 or SHA-512, is designed for storing passwords. SHA functions are built to be fast, which is exactly the wrong property for password storage, since fast hashing lets an attacker try billions of guesses per second on cracked password databases. Password storage should use a dedicated slow algorithm with built-in salting, such as bcrypt, scrypt, or Argon2, instead of a raw SHA hash.
Common mistakes
- Treating hashing as encryption. There is no way to reverse a hash back into the original text, so hashing is not a substitute for encrypting sensitive data you need to read again later.
- Expecting to decode a hash back to plain text. The only way to find an input that matches a known hash is to guess candidate inputs and hash them for comparison, which is how password crackers work.
- Using SHA-1 for new security-critical applications such as digital signatures or certificate generation, when SHA-1 has a known practical collision vulnerability.
- Hashing passwords directly with SHA-256 or SHA-512 for storage, without a unique per-user salt or a purpose-built slow algorithm such as bcrypt or Argon2.
- Comparing hashes visually instead of programmatically. A single differing character can be easy to miss by eye, so automated string comparison is more reliable when verifying a checksum.
Embed this calculator on your site
Drop this single line where you want the calculator to appear. It is responsive, mobile-friendly, resizes automatically, and is free to use with attribution.
<script src="https://calctide.com/embed.js" data-tool="hash-generator" async></script>Preview the embed at /embed/hash-generator/.