Verifying a downloaded file's checksum
Publishers list a SHA-256 for their release. Hash the text form of a value or compare tool output character for character; any difference at all means the content differs.
Hash Generator
Produce SHA-1, SHA-256, SHA-384, or SHA-512 digests from text in your browser using Web Crypto.
Maintained by Roshan.
Use Hash Generator
Produces a SHA digest from text using your browser's own Web Crypto implementation. The text never leaves the tab.
Hashing is one-way, and SHA-1 is not for securityA digest cannot be turned back into the text; matching one means hashing a guess and comparing. SHA-1 is offered for checksums and legacy systems, but collisions against it are practical, so never use it for signatures or passwords.
Explore generators
Find related browser-local tools for nearby tasks without starting another search.
Browse all generatorsAbout Hash Generator
A hash turns any amount of text into a fixed-length fingerprint. The same input always yields the same digest, a single changed character produces a completely different one, and the process cannot be run backwards. That combination makes hashes useful for checking that something arrived unaltered and for comparing values without storing them. Because the text is often exactly the kind of thing you would not want to paste into a stranger's server - a token, a config fragment, a snippet of a document - this page computes the digest in your browser using the same Web Crypto implementation that secures your connections.
Build the document
- Type or paste text and the digest recalculates immediately. There is no button because there is no round trip: the work happens in the tab as you type.
- Text is converted to UTF-8 bytes before hashing, which is what every other correct implementation does. It means accented letters, non-Latin scripts, and emoji all hash consistently with what your server or command line produces.
- Choose the algorithm to match whatever you are comparing against. SHA-256 is the sensible default; SHA-384 and SHA-512 produce longer digests; SHA-1 is available because checksums and older systems still use it.
- The digest is lowercase hexadecimal, which is the form printed by sha256sum, most language libraries, and most APIs. Comparing is a straight string match once both sides use the same case.
Ways to use Hash Generator
Comparing two long values quickly
Two configuration blocks that should be identical are tedious to diff by eye. Hash both and compare sixty-four characters instead of thousands.
Generating a cache key
Hashing a long parameter string gives a short, fixed-length key that is safe to use in a filename or storage bucket.
Check before sending it
- Hashing is one-way. There is no operation that turns a digest back into text. Sites offering to reverse a hash are searching a table of previously computed values, which works for common passwords and dictionary words and not for anything else. If you have lost the original, it is gone.
- SHA-1 is broken for security purposes. Practical collisions - two different inputs with the same digest - have been demonstrated, so it must not be used for signatures, certificates, or anything an adversary could manipulate. It remains fine for detecting accidental corruption, which is why it is still offered.
- MD5 is not available at all. Web Crypto does not implement it, and rather than shipping a hand-rolled version we leave it out. It has been unsuitable for security for two decades; if you need it for a legacy checksum, use a command-line tool.
- A plain hash is not password storage. Passwords need a slow algorithm with a per-user salt, such as bcrypt, scrypt, or Argon2. SHA functions are deliberately fast, which is exactly wrong for that job: speed helps the attacker far more than it helps you.
Questions about Hash Generator
Can a hash be reversed?
No. So-called reverse lookup services simply search precomputed tables of common inputs. For anything unpredictable, the original cannot be recovered from the digest.
Which algorithm should I choose?
SHA-256 unless something specific requires otherwise. Choose SHA-384 or SHA-512 when a longer digest is specified, and SHA-1 only when matching a legacy checksum.
Why is MD5 missing?
Web Crypto does not provide it, and implementing it by hand for a broken algorithm would be a poor trade. Use a command-line tool if a legacy system still demands MD5.
Can I hash passwords with this?
You should not. Password storage needs a deliberately slow algorithm with a salt, such as Argon2 or bcrypt. SHA functions are fast by design, which benefits an attacker running billions of guesses.
Related tools
Password Generator
Generate strong passwords in your browser using crypto.getRandomValues, with entropy shown in bits. Nothing is transmitted, logged, or stored.
UUID Generator
Generate one or a thousand version 4 UUIDs in your browser using a cryptographic random source. Copy them all at once, with nothing requested from a server.
Base64 Encoder and Decoder
Encode UTF-8 text to standard Base64 or decode Base64 back to Unicode text locally in your browser, with strict malformed and non-text error handling.
JSON to ENV
Turn a JSON object into .env format in your browser, with keys upper-cased and values quoted where a shell needs it.
Date to Unix Timestamp
Convert a date and time to a Unix timestamp in your browser.