Three Hashes, One Click
Enter any text and the tool computes its SHA-1, SHA-256, and SHA-512 digests simultaneously using the browser's built-in Web Crypto API — the same audited implementation TLS relies on, not a JavaScript re-implementation. Each result is shown as lowercase hex; click any hash to copy it.
Example — the SHA-256 of Hello World:
a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e
Change one character (Hello world, lowercase w) and every bit of the output reshuffles — that's the avalanche effect, and it's why hashes work as fingerprints.
Choosing an Algorithm
| Algorithm | Output | Status | Use it for |
|---|---|---|---|
| SHA-1 | 160 bit / 40 hex chars | Broken for collisions (2017) | Legacy compatibility only — git object IDs, old checksums |
| SHA-256 | 256 bit / 64 hex chars | Secure, industry default | File integrity, signatures, general fingerprinting |
| SHA-512 | 512 bit / 128 hex chars | Secure | Extra margin; often faster than SHA-256 on 64-bit CPUs |
Default to SHA-256 unless something forces your hand. SHA-1 collisions have been demonstrated in practice — two different inputs producing the same hash — so never use it where an attacker could benefit from forging a match. MD5 is even further gone and isn't offered here for that reason.
What Hashes Are For — and What They're Not
- Integrity checks: compare a downloaded file's published SHA-256 with your own computation; a match proves the bytes are identical.
- Deduplication and cache keys: hash the content, use the digest as an ID.
- Commit and content addressing: git, IPFS, and container registries all identify content by hash.
- Not encryption: hashing is one-way — there is no key and no decrypt. You can't recover the input from the digest.
- Not for passwords, even SHA-256: plain hashes compute billions of guesses per second on a GPU. Password storage needs a deliberately slow, salted algorithm — bcrypt, scrypt, or Argon2. If you need a strong password, use the password generator.
Deterministic, Local, Private
The same input always yields the same digest — that determinism is the whole point, and it also means anything guessable (a phone number, a dictionary word) can be reversed by brute-force lookup tables, which is exactly why unsalted hashes fail for passwords. All hashing here runs entirely in your browser via crypto.subtle.digest(); the text you enter never leaves your machine. For random identifiers rather than content fingerprints, use the UUID generator.