SHA Hash Generator
A fingerprint of your text or your file. The same input always gives the same hash; change one character and the whole thing changes. Computed here, so the file never leaves your machine.
How to use it
- Type or paste your text, or choose a file.
- Pick an algorithm. SHA-256 is the right answer unless something told you otherwise.
- Copy the hash and compare it with the one you were given.
What a hash actually is
A fixed-length fingerprint of whatever you put in. Two things are true of it and both matter. The same input always produces the same hash, on any machine, forever. And changing the input by a single character — a space, a full stop, one bit in a gigabyte — produces a completely different hash, not a similar one.
That is what makes it useful for checking that a download arrived intact, that a file has not been altered, or that two copies of something are identical without having to compare them byte by byte.
What it is not
It is not encryption. There is no key and no way back. If you hash a sentence you cannot recover the sentence from the hash, and neither can anyone else — including you, later, when you wish you could.
It is not a way to store passwords. This is the mistake that ends up in the news. A plain SHA-256 of a password can be attacked at billions of guesses a second on ordinary hardware, and identical passwords produce identical hashes, so one cracked account gives away every other account with that password. Password storage needs a deliberately slow algorithm with a per-user salt — bcrypt, scrypt or Argon2 — and none of those belong in a page like this.
It does not hide anything short. If the input is a postcode, a phone number or a date, anyone can hash every possible value and look yours up. A hash conceals nothing that is easy to guess.
Why SHA-1 is marked broken
Because a way has been demonstrated to produce two different files with the same SHA-1 hash. Once that is possible, SHA-1 can no longer prove a file is the one you expected, which was the entire job. It is kept here only because plenty of older systems still publish SHA-1 checksums and you may need to compare one.
MD5 is worse still and is not offered at all — browsers do not include it, and that is the right decision.
Files are read here, not uploaded
Choosing a file reads it in this page using the browser's own cryptographic library. Nothing is sent anywhere, which is the only sensible way to check the hash of something you have not decided to trust yet.
Frequently asked questions
Which algorithm should I pick?
SHA-256, unless whoever gave you the hash to compare used something else. SHA-384 and SHA-512 are longer but not meaningfully safer for ordinary use, and they are slower on some devices.
Can I get my text back from the hash?
No. A hash only goes one way - that is the point of it. If you need to get something back, you want encryption, which needs a key and is a different tool entirely.
Is it safe to hash my password here?
The page will do it and nothing leaves your browser, but the result is not how passwords should be stored. A plain SHA hash of a password can be guessed at enormous speed. Real password storage uses bcrypt, scrypt or Argon2 with a salt.
Why is my file hash different from the website's?
Usually the download was incomplete or was a different version. Occasionally the site published a hash of a different algorithm than the one you picked - check whether they said SHA-256 or SHA-1. A single changed byte changes the whole hash, so 'nearly matching' never happens.
Is there a size limit on the file?
Large files are read entirely into memory to hash them, so a very large one can make the tab struggle. A few hundred megabytes is comfortable on most machines; several gigabytes is not.
Is my text sent anywhere?
No. Everything happens in JavaScript inside your own browser. Nothing is uploaded and nothing is saved - close the tab and it is gone.