Hash Generator (SHA-256, SHA-1, SHA-512)
Compute a SHA-256, SHA-1, SHA-384 or SHA-512 digest for text or a file. Paste an expected digest to verify it.
How it works
- Choose the Text tab or the File tab.
- Pick the algorithm and the output format (Hex / Base64).
- Copy the digest or compare it with the expected digest.
Why this tool
- Four algorithms: SHA-256, SHA-1, SHA-384 and SHA-512.
- Hex and Base64 output formats.
- Paste an expected digest and see the match at once.
- Files up to 500 MB. The file is not uploaded.
- It uses the WebCrypto engine of your browser.
A hash turns data into a fixed length fingerprint. SHA-256 gives a 64 character hexadecimal string for any input. Change one bit and the whole digest changes. That makes it the most practical way to check that a file is intact.
The most common use is download verification. You download an installer and the publisher prints a SHA-256 value on the page. Drop the file here and paste the expected digest. If they match, the file was not damaged in transfer and was not changed. If they do not match, download it again.
The algorithm choice is simple. Use SHA-256 for new work. SHA-1 is no longer safe. In 2017 researchers produced two different files with the same SHA-1 digest. Keep it only for old systems. SHA-384 and SHA-512 give a longer digest and run fast on 64 bit machines.
One misunderstanding: a hash is not encryption. You cannot go back, but it does not give privacy either. The digest of a short and predictable text sits in ready-made tables. To store passwords you need bcrypt, scrypt or Argon2. Those are slow on purpose and they use a salt.
The work runs in the browser WebCrypto engine. The file does not go to a server. The file is read into memory in one piece, so the limit is 500 MB.
Frequently asked questions
Can a hash be reversed?
No. A digest is one way. The same input always gives the same digest, but you cannot go back. Short and predictable inputs can be found in ready-made tables.
Which algorithm should I pick?
Use SHA-256 for new work. SHA-1 is broken. Keep it only for old systems. SHA-384 and SHA-512 give a longer digest.
How do I verify a download?
Paste the digest from the publisher into the "Expected digest" field and select the file. A match means the file is intact and unchanged.
Why is MD5 missing?
The browser WebCrypto engine has no MD5. MD5 is not safe anyway. It is easy to build two files with the same digest.
Can I use it to store passwords?
No. Passwords need a slow, salted method such as bcrypt, scrypt or Argon2. Plain SHA-256 is far too fast for that job.
Does my file go to a server?
No. The file is read and hashed in your browser. It is held in memory in one piece, so above 500 MB the browser can fail.