Hash Generator
Generate SHA-256, SHA-384 and SHA-512 hashes of text as hex or Base64 and compare against a known hash. Uses your browser's crypto; nothing is uploaded.
A hash is a one-way fingerprint, not encryption: it cannot be reversed to recover the text. Do not use plain SHA-2 to store passwords; use a slow password hash such as Argon2, scrypt or bcrypt.
Type or paste text above to see its SHA-256, SHA-384 and SHA-512 hashes. Hashing the empty string is not shown; see the examples below the tool.
Processed locally in your browser. Your data never leaves your device.
About this hash generator
A cryptographic hash function turns any input into a short, fixed-length fingerprint. Change one character of the input and the hash changes completely; the same input always gives the same hash. This tool computes SHA-256, SHA-384 and SHA-512 (the SHA-2 family) of your text using your browser's Web Crypto API, and shows them as hex or Base64.
How to use it
- Type or paste text. The hashes update after a short pause.
- Choose how to display them: lower-case hex, upper-case hex or Base64. Changing the display never recomputes the hash.
- Copy any hash, or paste an expected hash into the compare field to see which algorithm it matches.
Example
The SHA-256 hash of abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. This is the official NIST test vector, so you can use it to confirm that any tool is computing SHA-256 correctly. The hash of the empty string is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
Which SHA-2 hash should I pick?
- SHA-256 (256 bits, 64 hex characters) is the default choice for checksums, content addressing, ETags and signatures.
- SHA-384 and SHA-512 produce longer digests. SHA-512 is often faster than SHA-256 on 64-bit CPUs for large inputs.
Hashes are not a security feature by themselves
- Not encryption. A hash cannot be decrypted, but short or guessable inputs (a common password, a phone number) can be found by trying candidates.
- Not for passwords. Use Argon2id, scrypt or bcrypt, which are slow on purpose and salted.
- Integrity, not authenticity. A plain hash shows that data has not changed only if you got the hash from a trusted place. To prove who created data you need a signature or an HMAC with a secret key.
- Text encoding matters. The same characters can be different bytes in different encodings. This tool hashes UTF-8, which is what most systems expect.
Frequently asked questions
- Is hashing the same as encryption?
- No. Encryption is reversible with a key. A cryptographic hash is a one-way function: the same input always gives the same fixed-length output, but you cannot recover the input from it. Hashes are used to check integrity and to fingerprint data.
- Can I use SHA-256 to store passwords?
- No. SHA-2 hashes are designed to be fast, which lets attackers try billions of guesses per second. Store passwords with a deliberately slow, salted password hash such as Argon2id, scrypt or bcrypt.
- Why is there no MD5 or SHA-1?
- Both are broken for security purposes: practical collision attacks exist, so they must not be used to verify integrity or authenticity. The browser's crypto API offers the SHA-2 family, which this tool provides.
- How do I check a downloaded file against a published hash?
- Compute the file's hash with a tool that reads files (for example sha256sum on Linux and macOS, or Get-FileHash on Windows) and compare it with the published value. This page hashes text, and its compare field tells you which algorithm a pasted hash matches.
- Is my text sent to a server?
- No. Hashes are computed by your browser's built-in crypto API. Nothing you type or paste is uploaded, stored or logged.