Skip to content
FlipConverto home

Hash Generator

A SHA-256 hash generator, with SHA-1, SHA-384 and SHA-512 too, computed by your browser's native cryptography.

Loading Hash Generator…

Runs entirely in your browser. What you enter stays on your device — nothing is sent to a server. Verify it yourself

Can a hash be reversed?

No. Hashing is one-way by design. Services advertising "hash decryption" work by looking the value up in a precomputed table of common inputs — they are not reversing anything, which is also why adding a salt defeats them.

Cost
Free, no limits
Upload
None — runs on your device
Sign-up
Not required
Works offline
Yes, once loaded

How to generate a SHA-256 hash

  1. Type or paste the text

    Into Text to hash.

  2. Read the hashes

    SHA-1, SHA-256, SHA-384 and SHA-512 update as you type. SHA-1 is marked as broken; use SHA-256 or longer for anything new.

  3. Copy the one you need

    Each hash has its own Copy button.

Examples

  • helloA 64-character SHA-256 hex digest

    The same input always produces the same digest.

  • HelloA completely different digest

    A one-bit change alters roughly half the output bits — the avalanche property.

Key features of the Hash Generator

  • SHA-1, SHA-256, SHA-384 and SHA-512
  • Uses the browser's own Web Crypto implementation
  • Hashes update as you type
  • The input never leaves your device

Supported formats

Algorithms

  • SHA-1
  • SHA-256
  • SHA-384
  • SHA-512

Output

  • Lowercase hexadecimal

When should you use this?

  • Checking a downloaded file's checksum against a published value.
  • Producing a stable identifier from a string.
  • Comparing two values without storing either.
  • Understanding what a Git object hash represents.

Limitations

  • SHA-1 is broken for security purposes — practical collisions have been demonstrated. It is offered here because Git and older checksums still use it, not because it should be used for anything new.
  • Hashing is not encryption. There is no key and no way back; a digest cannot be reversed into its input.
  • A plain hash is the wrong tool for storing passwords. It is far too fast, which is exactly what an attacker wants. Password storage needs a deliberately slow, salted algorithm such as bcrypt or Argon2.
  • This hashes text you type. Verifying a file's checksum needs a tool that reads the file bytes.

Troubleshooting

My digest does not match the published one

Check for a trailing newline or different line endings in the input, and confirm the algorithm matches. Hashing the file itself is also different from hashing a string that represents it.

The tool reports Web Crypto is unavailable

Browsers only expose the crypto API in secure contexts. Over plain HTTP on a non-localhost origin, it is unavailable by design.

Common mistakes to avoid

  • Using a bare SHA hash for passwords. Speed is the vulnerability, and SHA is designed to be fast.
  • Expecting to reverse a hash. Lookup tables exist for common inputs, but that is a dictionary attack, not decryption.
  • Using SHA-1 for anything where collision resistance matters.

Pro tips

Tips for better results

  • Choosing

    Reach for SHA-256 first

    SHA-256 is the sensible default for anything new. SHA-512 is not meaningfully more secure for most purposes, though it is faster on 64-bit hardware.

  • Checksums

    Compare the whole string, not the ends

    When comparing a checksum, compare the whole string. Checking the first and last few characters is a habit that defeats the point.

Standards and terms behind the Hash Generator

The named things this tool works with, and the documents that define them.

SHA-2 (FIPS 180-4)Specification
NIST's hash family, including SHA-256 and SHA-512, used for checksums and signatures. Reference: SHA-2 (FIPS 180-4)
NISTWho made it
The US standards institute that publishes the SHA hash functions and the digital identity guidelines.
Unicode and UTF-8Specification
The character set and encoding that let one text file hold every writing system.

Also searched as: sha-256 of a string, verify a checksum, file integrity hash.

What a hash is for

A cryptographic hash maps any input to a fixed-length value such that the same input always produces the same output, a different input almost certainly produces a different output, and the output cannot be reversed. That makes hashes useful for verifying that a file arrived intact, for detecting whether something changed, and as a building block inside signature and authentication schemes.

Why SHA-1 is here but marked broken

SHA-1 has been considered cryptographically broken since 2017, when a practical collision was demonstrated — two different inputs producing the same hash. It must not be used for security. It is offered here because Git object IDs, older checksums and some legacy protocols still use it, and matching an existing value is a legitimate need.

Why there is no MD5

MD5 has been collision-broken since 2004 and the Web Crypto API does not implement it. Adding a third-party library to provide it would mean shipping extra code specifically to offer a hash that should not be used — so the tool does not.

Hashing is not password storage

A plain SHA-256 of a password is fast to compute, which is exactly what makes it a poor password hash — an attacker with the hash can try billions of guesses per second on commodity hardware. Password storage needs a deliberately slow, salted algorithm designed for the job: bcrypt, scrypt or Argon2.

Privacy

The Hash Generator runs entirely in your browser. What you enter and the result it produces stay on your own device — nothing is sent anywhere, because nothing needs to be.

You can confirm this rather than take our word for it: open your browser’s developer tools, watch the Network tab, and use the tool. No request carries your input. It also keeps working with the connection off.

Details are in the privacy policy.

More developer tools

What next?

Built on the same cryptographic random source.

Generate a random secret

Hash Generator — questions

Can a hash be reversed?

No. Hashing is one-way by design. "Hash decrypters" work by looking the value up in a table of pre-computed hashes of common inputs — they are not reversing anything, which is also why salting defeats them.

Which hash should I use?

SHA-256 for almost everything. Use SHA-512 where you specifically want a longer digest. Do not use SHA-1 for anything security-related — it is included here only for matching legacy values such as Git object IDs.

Why is MD5 not offered?

It has been collision-broken since 2004, and the browser's Web Crypto API does not implement it. Providing it would mean shipping an extra library specifically to offer a hash nobody should use.

Can I use SHA-256 to store passwords?

No. It is far too fast — an attacker can test billions of candidates per second. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted.

Part of Developer Tools · Browse every tool