- SHA-256 256-bit Recommended
Waiting for input - SHA-384 384-bit
Waiting for input - SHA-512 512-bit
Waiting for input - SHA-1 160-bit Legacy
Waiting for input
Hashing runs on your device with the Web Crypto API. Text and files never leave the browser.
About the Hash Generator
Generate cryptographic hashes from text using the browser built-in Web Crypto API. A hash is a fixed-length fingerprint of its input: the same input always yields the same digest, and any change — even a single character — produces a completely different result. Because hashing runs locally, you can safely hash values you would not paste into a remote service.
How to use the Hash Generator
-
Enter text or drop a file
Type or paste text, or switch to File and drop one in. Digests update as you type, and files are read locally rather than uploaded.
-
Pick the output
SHA-256, SHA-384, SHA-512 and SHA-1 appear side by side. Choose hex, uppercase hex or Base64, and turn on HMAC to sign with a secret key.
-
Copy or verify
Copy the digest you need, or paste a published checksum to confirm the file or text matches it.
When to use it
Verifying file integrity
Compare a computed digest against a published checksum to confirm content has not been altered.
Checking webhook signatures
Recompute the HMAC-SHA256 that providers such as GitHub or Stripe attach to each webhook and compare it with the signature header.
Comparing values without storing them
Check whether two inputs are identical by comparing digests rather than the raw values.
Frequently asked questions
Can a hash be reversed?
No. Hash functions are one-way by design. However, short or common inputs can be found by brute force or rainbow table lookup, so hashing alone does not make a weak password safe.
Should I use SHA-1?
Not for security. Practical collision attacks against SHA-1 have been demonstrated, so it is unsuitable for signatures or certificates. It remains available here for compatibility with legacy systems that still require it.
Is SHA-256 suitable for storing passwords?
No. Plain SHA-256 is far too fast, which makes brute-forcing cheap. Use a purpose-built password hash such as bcrypt, scrypt or Argon2, which are deliberately slow and salted.
What is the difference between SHA-256 and SHA-512?
Digest length — 256 bits versus 512 bits. SHA-512 can be faster on 64-bit hardware. For most integrity purposes SHA-256 is sufficient.
Is MD5 supported?
No. MD5 is cryptographically broken and is not provided by the Web Crypto API. Use SHA-256 instead.
Related tools
Browse all free online tools on Tooly — every one runs in your browser, with no account required.