Hash Generator (SHA-256)

How to Use the Hash Generator

1. 1. Enter your text. Any text, up to what your browser can hold in a text box.
2. 2. Press Generate Hashes. All four digests appear together, with SHA-256 highlighted as the recommended one.
3. 3. Choose the case. Uppercase hex switches every digest between lowercase (the usual convention) and uppercase; the underlying bytes are the same.
4. 4. Copy the digest you need with the button beside it.

The Four Algorithms

SHA-1, SHA-256, SHA-384 and SHA-512 are defined in the US government's Secure Hash Standard, FIPS 180-4. Each turns any input into a fixed-size digest. The size is the only visible difference in the output:

A cryptographic hash is a one-way fingerprint. The same input always gives the same digest, a tiny change gives an unrelated one, and the text cannot be recovered from the digest. MD5 is not offered because the Web Crypto API does not implement it.

Worked Example

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

a9993e364706816aba3e25717850c26c9cd0d89d

Those two are the published test vectors from the standard's examples, so you can confirm the tool against a source you trust. Now watch what one letter does. Changing "dog" to "cog" in The quick brown fox jumps over the lazy dog:

d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

e4c4d8f3bf76b692de791a173e05321150f7a345b46484fe427f6acc7ecc81be

These SHA-256 digests share nothing recognisable: 123 of the 256 bits differ, close to the half you would expect from unrelated values. This is the avalanche effect, and it is why a hash can show that a file or message has changed without revealing what changed.

Why Your Hash May Not Match

• Trailing newline. abc and abc followed by a line break are different inputs: the SHA-256 of abc plus a newline begins edeaaff3, not ba7816bf. The command echo abc | sha256sum hashes the newline too; use printf or echo -n to leave it out.
• Case and spaces. Abc hashes differently from abc, and so does a space at either end.
• Encoding. The tool hashes the UTF-8 bytes of what you typed. Text hashed as UTF-16 or Latin-1 elsewhere gives a different digest for any non-ASCII character.
• Line endings. Text pasted from a Windows file may hold carriage returns that a text box normalises away.

What This Tool Is Not For

• Files. It hashes text only. For a file, use shasum -a 256 file on macOS or Linux, or certutil -hashfile file SHA256 on Windows.
• Passwords. SHA-256 is designed to be fast, which helps an attacker guess passwords. Store passwords with a slow, salted password-hashing function such as Argon2id, scrypt or bcrypt.
• Keyed hashes. There is no HMAC or salt option.

Which Tool Do You Need?

For the hexadecimal view of the text itself rather than a digest of it, use Text to Hex. For a random identifier, the UUID Generator; for a random secret, the Password Generator.

Frequently Asked Questions

Is my text uploaded to a server?

No. Every digest is computed in your browser with the Web Crypto API (crypto.subtle.digest). Your text is not sent anywhere, and the tool keeps working if you go offline after the page loads.

What is a cryptographic hash?

A function that turns input of any length into a fixed-length digest. It is deterministic, one-way and sensitive to every bit of the input. Hashes are used to check file integrity, in digital signatures and in commit identifiers, among other places.

Which hash algorithm should I use?

SHA-256 for almost everything. SHA-384 and SHA-512 give longer digests from the same family. Use SHA-1 only when an old system requires it, and never for security.

Is SHA-1 safe to use?

Not for security. The 2017 SHAttered attack produced two different PDF files with the same SHA-1 digest, and NIST says it should be phased out by the end of 2030. It remains acceptable for non-security checksums where an attacker is not a concern.

Why is there no MD5 option?

The Web Crypto API does not implement MD5, and the tool uses only what the browser provides. MD5 has been unsuitable for security for many years.

Can I hash a file with this tool?

No, it accepts text only. Use your operating system's command-line tool for files, as described above.

Why does my SHA-256 differ from another site's?

Almost always the input differs by an invisible character such as a trailing newline or space, or a different text encoding. Check the exact bytes with Text to Hex.