Free SHA hash generator
Paste any text and this hash generator computes its SHA-1, SHA-256, SHA-384, or SHA-512 digest — a fixed-length one-way fingerprint — entirely in your browser, updated live, as you type.
On this page13 sections
Output is generated client-side in your browser. No data is transmitted to any server.
Results are estimates. Consult a professional.
What is a hash generator?
A hash generator turns any text you give it into a short, fixed-length string of hexadecimal characters called a hash (or digest). The hash is a one-way fingerprint of the input: the same text always produces the same hash, a single changed character produces a completely different one, and you cannot run the process backwards to recover the original text from the hash. This tool computes hashes with the SHA family of cryptographic hash functions — SHA-1, SHA-256, SHA-384 and SHA-512.
Type or paste text into the box above, choose an algorithm, and the digest appears instantly, updated live as you type. The default — the word hello hashed with SHA-256 — produces the 64-character hex string 2cf24dba…938b9824. Everything runs in your browser through the built-in Web Crypto API, so your text never leaves your device.
How cryptographic hashing works
A cryptographic hash function takes an input of any length — a word, a paragraph, or a multi-gigabyte file — and compresses it into a digest of a single fixed size. SHA-256 always outputs 256 bits, whether you feed it one letter or an entire book. Four properties make these functions useful, and they are what separate a cryptographic hash from a plain checksum.
- Deterministic — the same input always yields the same digest, on any machine, forever. That is what lets two parties compare a hash and agree the data matches.
- Fixed output size — every input maps to a digest of one length (256 bits for SHA-256), regardless of how large the input is.
- Avalanche effect — flipping a single bit of the input changes about half the output bits, so "hello" and "Hello" produce digests with nothing visibly in common.
- One-way (preimage resistant) — given a digest, there is no practical way to work out an input that produces it short of guessing. The function is easy to compute forwards and infeasible to reverse.
A fifth property, collision resistance, means it should be infeasible to find two different inputs that hash to the same value. This is the property that breaks first when an algorithm ages — and it is exactly why MD5 and SHA-1 are no longer safe for security use, as the security section below explains.
The SHA-1, SHA-256, SHA-384 and SHA-512 functions are defined by NIST in FIPS PUB 180-4, the Secure Hash Standard. It specifies each algorithm's padding, block size, and the exact bit-level operations the digest is built from.Hash algorithms and their output sizes
The digest length is set by the algorithm, not the input. A longer digest leaves more room and is harder to attack, which is why modern security standards centre on SHA-256 and above. This tool offers the four SHA variants in the table; MD5 is shown for reference only — it is not offered here, for the reasons in the security section.
| Algorithm | Output size | Hex characters | Status |
|---|---|---|---|
| MD5 | 128-bit | 32 | Broken — reference only, not offered by this tool |
| SHA-1 | 160-bit | 40 | Legacy — broken for collisions, avoid for security |
| SHA-256 | 256-bit | 64 | Recommended baseline |
| SHA-384 | 384-bit | 96 | SHA-2 family, truncated SHA-512 |
| SHA-512 | 512-bit | 128 | Strongest SHA-2 option here |
Output sizes per NIST FIPS 180-4 (SHA family) and RFC 1321 (MD5). One hex character encodes 4 bits, so a 256-bit digest is 64 hex characters. SHA-256, SHA-384 and SHA-512 are all part of the SHA-2 family.
A worked example: hashing “hello” with SHA-256
This is the tool's default. We hash the five-character string hello (lowercase, no quotes, no newline) with SHA-256 and read off the 64-character result.
Step 1 — Encode the text as bytes
SHA-256 works on bytes, not characters, so the input is first encoded as UTF-8. The word "hello" becomes the five bytes 68 65 6c 6c 6f.
Step 2 — Run the SHA-256 compression
Those bytes are padded and processed through the SHA-256 rounds defined in FIPS 180-4. The function outputs a 256-bit digest, which the tool renders as 64 lowercase hex characters.
Step 3 — Read the digest
What hashes are actually used for
Because a hash is a compact, deterministic fingerprint of data, it is the standard way to answer one question fast: "is this exactly the same data as before?" That single idea covers most everyday uses.
- File integrity and checksums — software downloads publish a SHA-256 of the file so you can hash your copy and confirm it arrived intact and untampered. If even one byte changed in transit, the digests will not match.
- Deduplication — backup and storage systems hash each block of data and store any given hash only once, so identical files or chunks are not saved twice.
- Data fingerprinting and caching — content-addressed systems and cache keys name data by its hash, so the same content always resolves to the same identifier. Version-control tools like Git identify every commit by a hash.
- Detecting change — comparing the stored hash of a configuration file or document against a fresh hash flags whether anything was modified, without comparing the files byte by byte.
Note where hashing is the wrong tool: it does not generate random identifiers (use a UUID generator for that) and it does not store passwords safely on its own — that needs a purpose-built password hash, covered next.
Security: which algorithms are safe, and the password trap
Not every hash function is fit for every job. The biggest mistakes come from using a broken algorithm where collision resistance matters, or from using a fast general-purpose hash where a deliberately slow one is required. Two rules cover almost all of it.
- Do not use MD5 or SHA-1 where collisions matter. MD5 has been collision-broken since 2004, and a practical SHA-1 collision ("SHAttered") was demonstrated in 2017. That rules them out for digital signatures, certificates, and any place where an attacker forging a matching hash would cause harm. Use SHA-256 or stronger for new security work — which is why this tool does not offer MD5 at all.
- Never store passwords with a plain hash. SHA-256 is fast by design, so an attacker who steals a database of SHA-256 password hashes can test billions of guesses per second. Passwords must be protected with a slow, salted password-hashing function — bcrypt, scrypt, or Argon2 — not a raw SHA digest.
If you are choosing a password scheme, our password generator page explains the bcrypt/scrypt/Argon2 trade-offs in detail. And remember hashing is not encryption: to make text safely transportable rather than to fingerprint it, see the Base64 encoder, which encodes — it does not conceal — data.
NIST formally deprecated SHA-1 in 2022 and set a 2030 retirement, citing demonstrated collision attacks; the original SHA-1 collision ("SHAttered") was published by Stevens et al. in 2017. MD5 is specified in RFC 1321 and has been collision-broken since 2004.Does this hash generator send my text anywhere?
No. The hashing runs entirely in your browser through the standard Web Crypto digest function. The text you type is never stored, logged, or sent to any server — there is no network request, because none is needed. The page works the same offline, and the digest is computed by the same vetted code the browser uses for TLS.
Even so, a hash is one-way but not secret: if the original text is short or predictable, anyone can confirm a guess by recomputing its hash. Hashing a low-entropy value like a four-digit PIN does not protect it. Use hashing to fingerprint and verify data, and use real encryption when the goal is to keep the content itself hidden.
Hash generator definitions
How accurate is this hash generator?
The output is exact. Each digest is produced by the browser's native Web Crypto implementation of the algorithms in NIST FIPS 180-4, so it matches any correct SHA implementation byte for byte — the SHA-256 of "hello" is the same 64 hex characters here, on the command line, and in any standards-compliant library.
What a hash cannot tell you is anything about the meaning or origin of the data — only whether two pieces of data are identical. For generating identifiers rather than fingerprints, see the UUID generator; for choosing and sizing passwords safely, see the password generator.
Algorithm definitions and digest sizes follow NIST FIPS PUB 180-4 (Secure Hash Standard) for the SHA family and RFC 1321 for MD5.Frequently asked questions about the free SHA hash generator
About this hash generator
This hash generator runs entirely in your browser using the standard Web Crypto API. The text you enter is never stored, logged, or sent to any server — the SHA-1, SHA-256, SHA-384, and SHA-512 digests are computed locally, so the tool works the same offline. It produces a one-way fingerprint for integrity and deduplication, not encryption, and is not a substitute for a salted password-hashing function.
It is one of our free developer tools. For random identifiers see the UUID generator, or browse the full set on the all calculators page.