Hash Generator

Enter text below to generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes at once, or supply a key to sign it with HMAC. Uses the Web Crypto API. All processing happens locally in your browser.

About Hash Functions

A cryptographic hash function takes an input and produces a fixed-size string of bytes. The output (hash) is unique to the input - even a tiny change produces a completely different hash.

  • SHA-1 - 160-bit, deprecated for security use. Still used in Git.
  • SHA-256 - 256-bit, part of SHA-2 family. Recommended for general use.
  • SHA-384 - 384-bit, part of SHA-2 family. Truncated variant of SHA-512.
  • SHA-512 - 512-bit, part of SHA-2 family. Strongest standard hash.

Every digest on this page comes from the browser's own Web Crypto API, including the HMAC signatures. Nothing is implemented by hand and nothing is uploaded.

Two settings change the answer more than people expect. The character set decides which bytes are hashed, so the same sentence gives a different digest in UTF-8 and in Windows-1252. The line ending setting matters for anything that came out of a file, because a digest taken over CRLF will never match one taken over LF. Paste a checksum into the compare field and the page tells you which of the four it came from, which is the quickest way to identify an unlabelled hash.

Related tools

Bcrypt Generator & Checker Base64 Encode UUID Generator

How are you actually storing that?

Hashes, tokens and passwords are only as strong as the code around them: a cost factor left at the default, a token nobody checks the expiry on, a secret committed to the repository. We review and harden applications, and we tell you what an attacker reaches first.

Book a security review

Frequently Asked Questions

Why do I get a different hash than another tool?
Almost always because the bytes differ, not the algorithm. A trailing newline, CRLF instead of LF, or text encoded in Windows-1252 rather than UTF-8 all change the input and therefore the digest. The character set and line ending settings on this page exist to make those differences explicit.
Where did MD5 go?
It was removed. MD5 has practical collision attacks, so it proves nothing about a file an attacker could have touched, and the browser's crypto interface does not offer it, which meant carrying an implementation written out by hand in the page. SHA-256 is the sensible default for anything new.
What is HMAC and when do I need it?
HMAC mixes a shared secret into the digest, so only someone holding the key can produce or check it. Use it for webhook signatures and API request signing, where a plain hash proves nothing because anyone can compute one over the same body.
Which of these should I actually use?
SHA-256 unless you have a reason not to. SHA-512 is not meaningfully stronger for most purposes and is faster on 64 bit hardware, so it is a reasonable default too. SHA-1 is here because so much existing software still emits it, not as a recommendation: it has practical collision attacks and should not guard anything.
Does my text reach your server?
No. Every digest is computed in your browser, four of them by the browser's own crypto interface. Nothing you type is uploaded, which is what makes it safe to hash a token, a config file or anything else you would not paste into a remote service.