Generate SHA-256, SHA-1 and SHA-512 cryptographic hashes
Built & maintained by Pappu Venkata Subbi Reddy, founder of Clacify
The Hash Generator computes SHA-1, SHA-256, and SHA-512 cryptographic hashes of any text you enter, instantly and locally. Paste or type text and it produces all three hash digests at once, each ready to copy. Developers use this to verify file or message integrity, generate stable identifiers from content, and check that a downloaded file or a piece of data matches its published checksum. Because hashing runs through the browser's own Web Crypto API rather than a JavaScript re-implementation, the results are bit-for-bit identical to what any standard cryptographic library — OpenSSL, Python's hashlib, a backend language's crypto module — would produce for the same input, and nothing you type is ever sent anywhere to compute it.
Each hash is computed with crypto.subtle.digest, part of the Web Crypto API implemented natively by the browser — not a JavaScript emulation — using the exact SHA-1, SHA-256, and SHA-512 algorithms specified in FIPS 180-4. The input text is first encoded to raw bytes (UTF-8) with TextEncoder, digested, and the resulting byte array is formatted as a lowercase hexadecimal string, which is the standard representation used by command-line tools like sha256sum and by every published checksum you're likely to compare against. Because the same standardised algorithm and byte encoding are used everywhere, a hash generated here for a given input will always match the hash generated by any other correct implementation for that identical input.
A cryptographic hash function takes input of any size and produces a fixed-length "fingerprint" — 40 hex characters for SHA-1, 64 for SHA-256, 128 for SHA-512 — with three properties that matter: the same input always produces the same output (deterministic), a tiny change to the input (even one character) produces a completely different output (avalanche effect), and it is computationally infeasible to work backwards from the hash to recover the original input (one-way). That last property is why hashing is not encryption: encryption is reversible with the right key, hashing is deliberately, permanently one-directional. A hash tells you whether two pieces of data are identical without revealing what either of them actually contains.
SHA-1 is included here because it's still widely encountered — some legacy systems, Git's older object hashing, and older checksums still use it — but it has been cryptographically broken since 2017, when researchers demonstrated a practical "collision" (two different inputs producing the same hash), which defeats its use for anything security-critical like verifying a file hasn't been tampered with by an adversary. SHA-256 and SHA-512 (both part of the SHA-2 family) remain unbroken and are the current standard for password hashing pipelines (typically combined with a salt and a slow algorithm like bcrypt, not used raw), TLS certificates, blockchain, and file-integrity verification. The practical rule: use SHA-1 only when you're matching a legacy system that requires it; use SHA-256 or SHA-512 for anything new.
Verifying a downloaded file against a publisher's published SHA-256 checksum (hash the file, compare the string — if even one bit differs, the hashes look completely different, catching corruption or tampering instantly); generating a deterministic cache key or database index from a piece of content so identical content always maps to the same key; and checking that two pieces of text are byte-for-byte identical without having to diff them manually — if the hashes match, the content matches. Note this tool hashes the text you type, not a file — for verifying a downloaded file's checksum, most operating systems have a built-in command (certutil -hashfile on Windows, shasum on macOS/Linux) that hashes the file itself.
SHA-256 is a widely used cryptographic hash function that produces a fixed 256-bit (64-character hex) output from any input. It is used for verifying file integrity (checksums), in blockchain (Bitcoin mining), SSL certificate fingerprints, signing JWTs, and as a building block in many security protocols.
SHA-256 alone is not recommended for password storage because it is too fast — attackers can test billions of SHA-256 hashes per second using GPUs. For password storage, use purpose-built slow hash functions: bcrypt, Argon2id, or scrypt. These include a salt and are deliberately slow to make brute-force attacks impractical.