🔐 Hash Generator: SHA-1, SHA-256, and SHA-512 Online

What is the Hash Generator?

A cryptographic hash function takes input of any length and produces a fixed-size string of bytes, usually shown as hexadecimal. The same input always produces the same digest, but even a one-character change produces a completely different result, a property called the avalanche effect. Good hash functions are one-way: you cannot feasibly reverse a digest back into the original text, and you cannot easily find two different inputs that share the same digest (a collision). These properties make hashes useful for verifying file integrity, indexing data, fingerprinting content, and storing password verifiers when combined with a salt and a slow algorithm.

This tool covers the SHA family. SHA-1 produces a 160-bit (40 hex character) digest and is now considered broken for security purposes: Google and CWI Amsterdam demonstrated a practical collision attack in 2017 (the "SHAttered" attack), so SHA-1 should only be used for non-security tasks like legacy checksums or systems that still require it, such as older Git commit hashes. SHA-256 and SHA-512 belong to the SHA-2 family and produce 256-bit (64 hex character) and 512-bit (128 hex character) digests respectively. Both are widely trusted and are the right default for new work. SHA-512 is not "more secure for everyone": on 64-bit hardware it can be faster than SHA-256 because it processes data in larger 64-bit words, but SHA-256 remains the more common choice in TLS certificates, code signing, and most protocols.

Hashing shows up across everyday computing in ways most people never notice. SHA-256 is the algorithm behind Bitcoin mining and block hashing, it verifies the checksums Linux distributions and software vendors publish next to download links, and it underpins TLS certificates that make the padlock icon appear in your browser. SHA-1, despite being broken for security, was the object-identifier hash Git used for every commit until the project began migrating to SHA-256 in recent years. Databases and content delivery networks use hashes for deduplication, spotting two files or records that are byte-for-byte identical without comparing them directly. None of this requires the hash to be secret, only unique and tamper-evident.

MD5 is intentionally not offered here. It is cryptographically broken, with trivial, fast collision attacks that make it unsuitable even for many non-security checksums, and it is not part of the Web Crypto API that powers this tool. Some hash generator sites still list MD5 for legacy compatibility with old systems, but for anything new, SHA-256 is a strictly better default at effectively the same cost. This tool also does not offer HMAC (keyed hashing used to verify a message came from someone holding a shared secret) because that needs a secret key input in addition to the message, which is a different workflow from simple text hashing; if you need HMAC-SHA256 for an API signature, look for a dedicated HMAC tool that accepts both a message and a key.

It is worth being precise about what hashing is not. Hashing is not encryption: encryption is reversible with the right key, while a hash has no key and no reverse operation. Hashing is also not the same as encoding schemes like Base64 or URL encoding, which just represent the same data differently and are trivially reversible by design, not intended for security at all. A hash proves that data has not changed since the hash was taken; it says nothing on its own about who created the data unless it is combined with a digital signature. Confusing these three concepts is one of the most common mistakes people make when reading about "hashing a password" or "hashing a file."

This tool hashes text you type or paste, not files. Hashing the same content still produces the same digest either way, since a hash function only cares about bytes, but to verify a downloaded file (an ISO image, an installer, a ZIP archive) you generally need a tool that reads the file directly. On Windows, `certutil -hashfile <path> SHA256` computes a file hash from the command line; on macOS or Linux, `shasum -a 256 <path>` or `sha256sum <path>` does the same. Compare the result against the checksum the publisher listed on their download page to confirm the file was not corrupted or tampered with in transit.

When to use it

• Generating a SHA-256 checksum to verify that a downloaded file, package, or pasted snippet has not been altered.
• Producing a stable, fixed-length key from a longer string for caching, deduplication, or database indexing.
• Comparing a value against an expected hash published by a vendor, release page, or API documentation.
• Learning and testing how hashing works while building, debugging, or teaching a course on an application.
• Creating a content fingerprint to detect whether two pasted blocks of text are byte-for-byte identical.
• Generating a quick, non-secret identifier for logging or tracking a piece of text without storing the text itself.

How to use the Hash Generator

1. Type or paste your text into the input box.
2. Read the SHA-1, SHA-256, and SHA-512 digests, which update automatically as you type.
3. Click the Copy button next to any hash to copy that digest to your clipboard.
4. Pick SHA-256 (or SHA-512) for anything security related, and treat SHA-1 as legacy only.
5. If you need to verify a downloaded file rather than typed text, use a command-line hash tool (certutil, shasum, or sha256sum) instead, since this page hashes text input only.

Formula & method

Worked examples

SHA algorithm comparison

Known digests of common inputs (UTF-8, SHA-256)

Where each algorithm shows up in the real world

Common mistakes to avoid

• Treating SHA-1 as secure. SHA-1 has practical collision attacks (demonstrated publicly in 2017) and should not be used for signatures, certificates, or password storage. Use SHA-256 or SHA-512 for anything where security matters.
• Expecting hashing to be reversible. A hash is one-way. There is no "decrypt" step. If you need to recover the original value you want encryption, not hashing. Sites that claim to "decode" SHA-256 are just looking it up in a table of precomputed inputs.
• Storing raw password hashes. A plain SHA-256 of a password is too fast and unsalted, so it is weak against brute force. For passwords use a slow, salted algorithm such as bcrypt, scrypt, or Argon2 instead of a bare SHA digest.
• Ignoring encoding differences. This tool hashes the UTF-8 bytes of your text. The same characters encoded as UTF-16, or with a trailing newline added, will produce a different digest. Match the encoding of whatever you are comparing against.
• Comparing hashes with hidden whitespace or case differences. A trailing space, an extra newline, or copying text with different line-ending characters (CRLF vs LF) changes every bit of the hash. Trim and normalize both values before assuming they should match.
• Trying to hash a file by pasting its contents. This tool hashes text input, not raw binary files. Pasting a file into a text box can mangle binary data or change its encoding, producing a digest that does not match the file itself. Use a command-line tool like certutil, shasum, or sha256sum to hash files directly.

Glossary

Hash function

An algorithm that maps input of any size to a fixed-size output, designed so the same input always yields the same result.

Digest

The fixed-size output of a hash function, often shown as a hexadecimal string.

SHA-2

A family of secure hash algorithms that includes SHA-256 and SHA-512, published by NIST and widely used today.

Collision

When two different inputs produce the same hash digest. A strong hash function makes finding one infeasible.

Salt

A random value added to input (typically a password) before hashing so that identical inputs hash differently.

Hex (hexadecimal)

A base-16 number system using 0-9 and a-f. Each hex character represents 4 bits, so two characters represent one byte.

HMAC

A keyed hash that combines a message with a secret key, used to prove a message came from someone holding that key. Not the same as plain hashing.

Avalanche effect

The property where changing even one character of input flips roughly half the bits in the output digest, making outputs look completely unrelated.

Frequently asked questions