SHA-256 — sensible default for integrity checks, content addressing (Git, IPFS-style), HMAC keys, and signatures. SHA-384 / SHA-512 — useful when you need a wider digest (PBKDF2/HKDF tuning, larger HMAC keys, post-quantum-margin habits). SHA-1 — for compatibility only (Git object IDs, legacy CI checksums). Don't use for security boundaries — practical collision attacks have existed since 2017.

Hashing is not encryption. Hashes are one-way; you can't get the original back. If you need confidentiality, encrypt. Don't hash passwords with raw SHA-256. Plain SHA is fast — that helps attackers brute-force. Use a slow KDF (Argon2id, bcrypt, scrypt) for password storage. MD5 is intentionally absent. Broken since the early 2000s. Anywhere you "need" MD5, you also need to flag a security review. Whitespace matters. A trailing newline produces a different hash than the same text without one. Compare hex output exactly.

Hash Generator

Hash text with SHA-1, SHA-256, SHA-384 or SHA-512 using your browser's WebCrypto. Computed locally — input never leaves the page.

Input

Note: MD5 is not provided here — it is broken for security purposes. Use SHA-256 or higher for new applications.

SHA-1 160 bits — legacy, do not use for security

Enter input above to see the result.

SHA-256 256 bits — recommended default

Enter input above to see the result.

SHA-384 384 bits

Enter input above to see the result.

SHA-512 512 bits

Enter input above to see the result.

What is this for?

A cryptographic hash takes any input and produces a fixed-length fingerprint. Two identical inputs always hash to the same digest; changing a single bit changes the digest entirely. Hashes underpin file-integrity checks, content-addressable storage, digital signatures, and password-hashing pipelines (where they're combined with a slow function like Argon2 or bcrypt).

All hashing here uses the browser's crypto.subtle.digest — the same primitives that power TLS. Your input never leaves the page.

When to use which

SHA-256 — sensible default for integrity checks, content addressing (Git, IPFS-style), HMAC keys, and signatures.
SHA-384 / SHA-512 — useful when you need a wider digest (PBKDF2/HKDF tuning, larger HMAC keys, post-quantum-margin habits).
SHA-1 — for compatibility only (Git object IDs, legacy CI checksums). Don't use for security boundaries — practical collision attacks have existed since 2017.

Common gotchas

Hashing is not encryption. Hashes are one-way; you can't get the original back. If you need confidentiality, encrypt.
Don't hash passwords with raw SHA-256. Plain SHA is fast — that helps attackers brute-force. Use a slow KDF (Argon2id, bcrypt, scrypt) for password storage.
MD5 is intentionally absent. Broken since the early 2000s. Anywhere you "need" MD5, you also need to flag a security review.
Whitespace matters. A trailing newline produces a different hash than the same text without one. Compare hex output exactly.