Hash Generator

Features

• SHA-1, SHA-256, SHA-384 and SHA-512
• Hexadecimal or Base64 output
• Hash files of any size without uploading them
• Constant-time comparison against a known hash
• Computed by the browser's own crypto implementation

How to use it

1. Type or paste the text you want to hash.
2. All four digests update immediately.
3. Use “Hash a file” to checksum a download.
4. Paste a published hash into the verify box to compare.

What hashes are for, and what they are not for

A cryptographic hash maps any input to a fixed-size digest such that the same input always produces the same output, any change produces a completely different output, and the original cannot be recovered from the digest. That makes hashes ideal for integrity checking: download a file, hash it, compare against the published value, and you know whether it arrived intact.

SHA-1 is included here because you will still encounter it, Git uses it for object identifiers, and plenty of legacy systems publish SHA-1 checksums. It should not be used for anything security-relevant. A practical collision was demonstrated in 2017, and the cost of producing one has fallen since. Use SHA-256 or better for anything new.

The critical thing hashes are not suitable for is storing passwords. SHA-256 is designed to be fast, and fast is exactly wrong for password storage, modern hardware computes billions of SHA-256 hashes per second, so a stolen database of SHA-256 password hashes falls quickly to brute force. Password storage needs a deliberately slow, memory-hard, salted function: Argon2id, scrypt, or bcrypt. Adding a salt to SHA-256 helps against rainbow tables but does not fix the speed problem.