Which algorithms are supported?

SHA-1, SHA-256, SHA-384 and SHA-512 — exactly the digest set browsers expose through SubtleCrypto. Output is lowercase hex: 40, 64, 96 and 128 characters respectively. Input text is always hashed as UTF-8 bytes.

The Web Crypto API deliberately does not implement MD5, which has been collision-broken since 2004. If you must check a legacy MD5 checksum, use an offline tool such as md5sum; for anything new, publish and verify SHA-256 instead.

Is SHA-1 still safe to use?

Collisions against SHA-1 have been practical since the 2017 SHAttered attack, so it must not be used for signatures, certificates, or any security decision. It remains acceptable for detecting accidental corruption and for interoperating with systems that still emit SHA-1 sums.

Can I use these hashes to store passwords?

No. All four algorithms are fast by design, and an offline attacker with a GPU can try billions of guesses per second against fast hashes. Password storage needs a slow, salted algorithm — Argon2, bcrypt, or scrypt — via your framework’s auth library.

Can a hash be reversed or decrypted?

No — hashing is one-way, and there is no key, so there is nothing to decrypt. But guessable inputs can be recovered by hashing candidate values until one matches (dictionary and rainbow-table attacks), which is another reason short secrets should never be protected by a bare fast hash.

Why does my hash differ from another tool’s?

The input bytes differ. Common culprits: a trailing newline (shell echo adds one — use printf), CRLF versus LF line endings, or a different text encoding. The SHA-256 of hello is always 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 — if you get anything else, the bytes were not identical.

Is my text uploaded to a server?

No. Hashing runs locally through the browser’s crypto.subtle API — there is no network request, nothing is logged, and the page keeps working if you go offline after loading it. Sensitive text never leaves your device (though passwords should not be hashed this way at all — see above).

Hash Generator (SHA-1 / SHA-256 / SHA-384 / SHA-512)

Generate cryptographic hashes of text using the browser’s Web Crypto API. Nothing is uploaded.

Runs in your browser — files never leave your device

SHA-1

—

SHA-256

—

SHA-384

—

SHA-512

—

Note: MD5 isn’t available in the browser’s crypto API; SHA-256+ are recommended anyway.

How it works

Type or paste text and four digests are computed in parallel on every keystroke using crypto.subtle.digest — the browser’s native Web Crypto API. The text is first encoded as UTF-8 bytes, then hashed with SHA-1 (40 hex characters, 160 bits), SHA-256 (64 characters), SHA-384 (96) and SHA-512 (128 characters, 512 bits), each displayed as lowercase hexadecimal.

Hashes are deterministic, so results here match any correct implementation anywhere: the SHA-256 of hello is always 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. They are also avalanche-sensitive: capitalize one letter and the SHA-256 of Hello begins 185f8db3, sharing nothing recognizable with the previous digest. Those two properties are what make a hash a reliable fingerprint for data.

Choosing an algorithm: SHA-256 is the sensible default for checksums, content fingerprints, cache keys and deduplication. SHA-1 survives for legacy interop, but collisions have been practical since the 2017 SHAttered attack, so use it only to compare against existing SHA-1 checksums — never for signatures or anything security-relevant. SHA-384 and SHA-512 provide longer digests where a spec demands them. MD5 is absent because SubtleCrypto does not implement it (it has been collision-broken since 2004); if a vendor published only MD5 sums, you will need an offline tool such as md5sum.

Two boundaries worth stating plainly. Hashing is one-way — a digest cannot be decrypted — but guessable inputs can still be recovered by hashing candidates until one matches. And fast hashes must never store passwords: a GPU tries billions of SHA-256 guesses per second, so password storage belongs to slow, salted algorithms like Argon2, bcrypt or scrypt.

The classic gotcha when comparing digests across tools is invisible bytes: a trailing newline (shell echo appends one), CRLF versus LF line endings, or a different Unicode encoding each produce a completely different digest. If your result does not match a published checksum, compare the exact bytes before suspecting the hash.

Frequently asked questions

Which algorithms are supported?: SHA-1, SHA-256, SHA-384 and SHA-512 — exactly the digest set browsers expose through SubtleCrypto. Output is lowercase hex: 40, 64, 96 and 128 characters respectively. Input text is always hashed as UTF-8 bytes.
Why is there no MD5?: The Web Crypto API deliberately does not implement MD5, which has been collision-broken since 2004. If you must check a legacy MD5 checksum, use an offline tool such as md5sum; for anything new, publish and verify SHA-256 instead.
Is SHA-1 still safe to use?: Collisions against SHA-1 have been practical since the 2017 SHAttered attack, so it must not be used for signatures, certificates, or any security decision. It remains acceptable for detecting accidental corruption and for interoperating with systems that still emit SHA-1 sums.
Can I use these hashes to store passwords?: No. All four algorithms are fast by design, and an offline attacker with a GPU can try billions of guesses per second against fast hashes. Password storage needs a slow, salted algorithm — Argon2, bcrypt, or scrypt — via your framework’s auth library.
Can a hash be reversed or decrypted?: No — hashing is one-way, and there is no key, so there is nothing to decrypt. But guessable inputs can be recovered by hashing candidate values until one matches (dictionary and rainbow-table attacks), which is another reason short secrets should never be protected by a bare fast hash.
Why does my hash differ from another tool’s?: The input bytes differ. Common culprits: a trailing newline (shell echo adds one — use printf), CRLF versus LF line endings, or a different text encoding. The SHA-256 of hello is always 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 — if you get anything else, the bytes were not identical.
Is my text uploaded to a server?: No. Hashing runs locally through the browser’s crypto.subtle API — there is no network request, nothing is logged, and the page keeps working if you go offline after loading it. Sensitive text never leaves your device (though passwords should not be hashed this way at all — see above).

Hash Generator (SHA-1 / SHA-256 / SHA-384 / SHA-512)

How it works

Frequently asked questions

Related tools