Hash Generator
Compute SHA-256, SHA-512, SHA-384 or SHA-1 hashes of any text — instantly, with the browser's own Web Crypto API.
Nothing leaves your device. Hashing runs locally on this page.
About this tool
This free hash generator computes cryptographic hashes of any text using your browser's built-in Web Crypto API — the same implementation the browser itself uses for TLS. Supported algorithms: SHA-256, SHA-512, SHA-384 and SHA-1, output as lowercase hexadecimal.
Common uses: verifying that a file or string matches a known checksum (compare against a published SHA-256), generating cache-busting or content-addressed identifiers, checking what a password would look like after salting-plus-hashing, and integrity fields in configs.
Everything runs locally in your browser — nothing is uploaded, stored or sent anywhere, which makes it safe for sensitive strings.
Note: plain hashing is not password storage. For passwords use a purpose-built scheme such as bcrypt, scrypt or Argon2 — never a single fast SHA digest. SHA-1 is included only for compatibility with older systems; it is considered cryptographically broken for collision resistance.
Frequently asked questions
Is it safe to hash passwords with SHA-256 here?
SHA-256 alone is not a password-hashing scheme — it is fast by design. For storing passwords use a dedicated slow algorithm such as bcrypt, scrypt or Argon2 in your own backend. This tool is for verifying file integrity, deduplicating content and building cache keys.
Does my text get uploaded when I hash it?
No. Hashing runs entirely in JavaScript in your browser using the Web Crypto API. The text never leaves your device, so hashing sensitive strings is safe.
Which algorithm should I choose?
SHA-256 is the modern default and what you should reach for first. SHA-1 is broken for security purposes but still appears in legacy systems like old Git objects. MD5 is shown for compatibility checks only — never use it for anything security-related.
Why do two different texts sometimes give the same hash?
They should not, practically speaking. A collision on SHA-256 requires roughly 2^256/2 attempts — impossible with current technology. If you see a collision, the inputs are almost certainly identical after invisible characters like trailing spaces are accounted for.