Hash Generator

About the Hash Generator

A cryptographic hash function turns any amount of data into a short, fixed-size fingerprint. Feed it one word or an entire novel and you get a string of the same length back, always the same string for the same input, and a completely different string if even one character changes. That combination makes hashes useful for checking that data arrived unchanged, spotting duplicates, deriving cache keys, and signing or verifying messages. This page computes four of the standard ones for whatever text you type: SHA-1, SHA-256, SHA-384, and SHA-512.

The four results appear together and update on every keystroke, each with its own Copy button. They differ in the length of the fingerprint: SHA-1 gives 160 bits, shown as 40 hexadecimal characters, SHA-256 gives 64 characters, SHA-384 gives 96, and SHA-512 gives 128. SHA-256, SHA-384, and SHA-512 belong to the SHA-2 family and are considered secure for integrity checking today. SHA-1 is included for compatibility with older systems; practical collision attacks have been demonstrated against it, so it should not be used for anything security-sensitive.

Developers comparing a payload with a published digest, administrators verifying a configuration string, students learning how hashing behaves, and writers or testers who need a deterministic fingerprint of a phrase all use tools like this. Two warnings frame the rest of the page. A hash is not encryption, so it cannot be reversed to recover the text but can be guessed for short or common inputs. And the tool hashes exactly the characters in the box, including any trailing space or line break, which is the most frequent reason a result fails to match one produced elsewhere.

When to Use It

How to Use It, Step by Step

1. Click into the box labeled "Text to hash". It starts with the phrase "The quick brown fox", so select all of it and replace it with your own text.
2. Type or paste the text exactly as it should be hashed. Every character counts, including spaces, tabs, capital letters, punctuation, and line breaks. If you press Enter in the box, that line break becomes part of the hashed text.
3. Watch the four panels below the box, labeled SHA-1, SHA-256, SHA-384, and SHA-512. They are computed automatically on each change, so there is no button to press. While a result is being computed you may briefly see an ellipsis.
4. Choose the algorithm that matches what you are comparing against. If a vendor lists a 64-character digest, use SHA-256; 128 characters means SHA-512; 96 means SHA-384; 40 means SHA-1.
5. Compare the digest with the expected one. Hexadecimal digits are case-insensitive, so ABCD and abcd are the same value, but every other character must match in the same order.
6. Press the Copy button in the panel you need. The label changes to "Copied" for a moment, and the lowercase hexadecimal digest is on your clipboard.
7. If the digest does not match, look for invisible differences: a trailing newline, a space before or after the text, curly quotes instead of straight quotes, or a different capitalization. Fix those in the box and the result updates.

Understanding Your Results

Each panel shows the digest in lowercase hexadecimal. The length tells you the algorithm: 40 characters for SHA-1, 64 for SHA-256, 96 for SHA-384, and 128 for SHA-512. A digest never reveals anything about the original length or content, so two very different texts give outputs of identical length. The output depends only on the exact sequence of bytes, which the tool produces by encoding your text as UTF-8 before hashing.

A change anywhere in the input changes roughly half of the output bits, with no pattern. For instance, hello and Hello give SHA-256 values that differ in 125 of 256 bits, so the two digests look unrelated. This is what makes a hash a good tamper alarm: if the digests match, the inputs are, for all practical purposes, identical; if they differ, the inputs differ somewhere, but the digest does not tell you where.

An empty box still produces digests, because the empty string has a perfectly valid hash. The SHA-256 of nothing is e3b0c442 followed by many more characters, and the SHA-1 of nothing is da39a3ee5e6b4b0d3255bfef95601890afd80709. Seeing those values means the input is truly empty, not that something has gone wrong. Hashes of short, common phrases like password are easy to look up in published tables, so a hash alone does not protect a weak secret.

More Worked Examples

Tips for Better Results

• When matching a hash from another tool, first check its input handling. Command-line tools often hash file contents or piped text with a trailing newline, whereas this tool hashes only what is in the box.
• Paste text from a word processor with care. Curly quotes, non-breaking spaces, and en dashes look similar to the plain characters but are different bytes, producing a completely different hash.
• For a deterministic fingerprint, normalize your input first: trim whitespace, pick one capitalization, and fix the line-ending style, so that equivalent data always yields the same digest.
• Prefer SHA-256 as a general default. It is widely supported, compact enough to read and compare, and has no known practical attacks. SHA-512 gives a longer digest and can be faster on 64-bit processors for large inputs.
• Use the first 8 to 12 characters of a digest as a short label in notes or file names, but compare full digests when verifying anything important, since a short prefix can collide far more easily.
• Treat hashes of short, guessable text as non-secret. Anyone can hash a list of common passwords or names and compare, so do not publish the hash of a secret that is easy to guess.

Common Mistakes to Avoid

• Believing a hash can be decrypted. It is a one-way function with no key, so the only way to find an input is to guess candidates and hash them, which works for simple phrases but not for long random data.
• Using SHA-1 for anything security related. Researchers have produced two different documents with the same SHA-1 digest, so choose SHA-256 or stronger for signatures, certificates, and integrity checks.
• Storing passwords as a plain SHA-256 or SHA-512 digest. These are fast by design, which helps attackers; password storage requires a slow, salted algorithm such as bcrypt, scrypt, or Argon2.
• Comparing a hash of the text with the hash of a file. They are only equal if the file's bytes are exactly the same as the text encoded as UTF-8, including newlines and encoding.
• Ignoring character encoding. This tool hashes UTF-8 bytes, so a word with an accent, like café, gives a different digest than the unaccented cafe, and text saved in another encoding elsewhere may not match.

Assumptions and Limits

• Hashes are computed with the browser's built-in Web Crypto digest function on the UTF-8 encoding of your text. Results for the same bytes are identical to those from standard command-line tools.
• The tool accepts text only. It does not read files, so a file checksum must be produced with a command-line utility or another tool that reads file bytes.
• MD5 and other legacy algorithms are not offered. SHA-1 is shown only for compatibility with old systems and is not suitable where security matters.
• Matching digests show that two inputs are equal, but they cannot prove who created the data or that it is safe. For authenticity, you need a signature or a keyed method such as HMAC, which this tool does not provide.

Key Terms

Hash function

A procedure that maps data of any size to a fixed-size value. The same input always gives the same output, and the process cannot practically be run backward.

Digest

The fixed-length output of a hash function, usually written as a string of hexadecimal characters. It is also called a checksum or fingerprint.

Avalanche effect

The property that a tiny change in the input, such as one letter, changes about half the bits of the output in an unpredictable way.

Collision

Two different inputs that produce the same digest. A secure hash makes finding one computationally infeasible; for SHA-1, collisions have been demonstrated.

SHA-2

A family of hash functions published by the US government that includes SHA-256, SHA-384, and SHA-512. The number is the digest size in bits.