What a hash function does
A cryptographic hash turns any input into a fixed-length fingerprint called a digest. The same input always gives the same digest, but a one-character change produces a completely different one, and there is no practical way to work backwards from the digest to the input. This tool computes four hashes at once from the text you type, using your browser's Web Crypto API (crypto.subtle.digest). It encodes the text as UTF-8, hashes the bytes, and displays the result as lowercase hexadecimal.
The four algorithms offered
SHA-1 is defined in FIPS 180-1, and the SHA-2 family (SHA-256, SHA-384, SHA-512) in FIPS 180-4. Each hex character represents 4 bits, so the digest lengths below follow directly from the bit size.
| Algorithm | Digest size | Hex characters | Status |
|---|---|---|---|
| SHA-1 | 160 bits | 40 | Broken for collision resistance (the SHAttered attack, 2017). Fine for non-security checksums only. |
| SHA-256 | 256 bits | 64 | Secure. The default choice for integrity checks and fingerprints. |
| SHA-384 | 384 bits | 96 | Secure. A truncated variant of SHA-512. |
| SHA-512 | 512 bits | 128 | Secure. Often faster than SHA-256 on 64-bit CPUs. |
MD5 is deliberately not included. It is faster to attack than SHA-1 and has been broken for collisions since 2004, so it should not be used for anything where an attacker could matter.
Worked example
Hashing the text hello (five bytes, no newline) gives:
- SHA-1:
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d - SHA-256:
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Changing it to Hello with a capital H gives a SHA-256 of 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969, which shares nothing recognisable with the first.
Mistakes that cause "wrong" hashes
- Trailing newline or space.
helloandhellofollowed by a line break hash differently. Command-lineechoadds a newline unless told not to, which is the most common reason this tool disagrees with a terminal. - Hashing a file versus hashing text. This tool hashes the text in the box. A file's published checksum covers its raw bytes, so it will not match unless the file is plain text with identical line endings.
- Character encoding. Text is hashed as UTF-8. A system that hashes UTF-16 or Latin-1 produces a different digest for any non-ASCII input.
- Comparing case. Hex digests are case-insensitive in meaning, but a naive string comparison treats
Aandaas different.
Not for storing passwords
Plain SHA-256 is fast by design, which lets attackers test billions of guesses per second against stolen hashes. Password storage requires a deliberately slow, salted algorithm such as bcrypt or Argon2; the htpasswd generator creates bcrypt hashes for that purpose. To judge how guessable a password is, use the password strength checker.
Good uses for these hashes include verifying a download against a published checksum, spotting whether two pieces of text are identical, and generating deterministic cache keys. Digests are often also shown in Base64, so the Base64 tool can help when comparing formats.