UseToolSuite UseToolSuite

Hash Generator

Generate SHA-1, SHA-256, and SHA-512 cryptographic hashes from any text string. Uses the browser Web Crypto API — your input never leaves your device.

Drop a file here to compute its hash, or click to select

HMAC Generator

Hashing vs encryption vs encoding

These three are often confused but solve different problems. Encoding (like Base64) is reversible by anyone and protects nothing — it just reshapes data. Encryption is reversible by someone holding the key. Hashing is deliberately one-way: there is no key and no way back from digest to input. That’s why hashes are used for integrity checks and password storage, never for hiding data you’ll need to read again.

Algorithm comparison

AlgorithmDigest sizeStatusAppropriate uses
MD5128-bitBroken (collisions)Legacy checksums, cache keys
SHA-1160-bitBroken (collisions, 2017)Legacy Git objects, old protocols
SHA-256256-bitSecureFile integrity, signatures, general use
SHA-512512-bitSecureSame as SHA-256; faster on 64-bit CPUs

“Broken” means researchers can construct two different inputs with the same digest — fatal for signatures, irrelevant for detecting a corrupted download from a trusted mirror.

A practical integrity-check workflow

When a download page publishes a checksum: download the file, hash it locally with the same algorithm, and compare your digest to the published one character by character (or paste both into the compare field). A mismatch means the file was corrupted in transit or tampered with — delete it and re-download, ideally from a different mirror. Publishing checksums alongside artifacts you distribute (releases, datasets, firmware) lets your users do the same.

Why password storage needs more than a hash

Plain SHA-256 is too fast for passwords: an attacker with a GPU can test billions of candidates per second against stolen digests. Password storage requires deliberately slow, salted algorithms — bcrypt, scrypt, or Argon2 — where each guess costs real time. Use the Bcrypt Generator on this site for that job, and reserve plain hashes for data integrity.

Hash Generator Powered by UseToolSuite — free browser tools

Last updated

How helpful was this tool?

Click to rate

Embed this tool on your site

Paste this snippet into any HTML page or blog post to embed a live, fully working copy of Hash Generator. Free for any use.

Key Concepts

Cryptographic Hash Function

A one-way mathematical function that takes any input and produces a fixed-size output (digest) that is practically impossible to reverse. Key properties: deterministic (same input always produces the same hash), avalanche effect (a tiny input change completely changes the output), and collision-resistant (extremely hard to find two different inputs that produce the same hash).

SHA-2 Family

A set of cryptographic hash functions designed by the NSA, including SHA-256 (256-bit output) and SHA-512 (512-bit output). SHA-2 is the current industry standard for data integrity verification, digital signatures, and blockchain. It replaced SHA-1, which is now considered weak due to demonstrated collision attacks.

Salt (Cryptography)

A random value added to the input before hashing, primarily used in password storage. Salting ensures that identical passwords produce different hashes, defeating precomputed rainbow table attacks. Each user should have a unique salt stored alongside their hashed password.

Checksum

A hash value used to verify data integrity — confirming that a file or message has not been altered during transmission or storage. By comparing the checksum of the received data with the original, you can detect accidental corruption. Common checksum algorithms include SHA-256, MD5, and CRC32.

Frequently Asked Questions

Does this tool support MD5 hashing?

No. This tool uses the Web Crypto API, which supports SHA-1, SHA-256, SHA-384, and SHA-512. MD5 is not included in the Web Crypto API because it is considered cryptographically broken and should not be used for security purposes.

Can I verify a hash by comparing it to an expected value?

You can paste your original text, generate the hash, and then manually compare the output to your expected hash value. The comparison is straightforward since hashes are displayed as hexadecimal strings.

Is SHA-1 still safe to use?

SHA-1 is considered weak for cryptographic purposes and should not be used for digital signatures or certificates. However, it is still acceptable for non-security uses like checksums and deduplication. For security-sensitive applications, use SHA-256 or SHA-512.

Can I hash a file with this tool?

This tool hashes text input only. To hash a file, you would need to read the file contents as bytes first. For text files, you can paste the content directly into this tool.

Why do I get a different hash for the same text?

Hashes are bit-exact: a trailing newline, a different character encoding, or an invisible character (like a non-breaking space pasted from a web page) produces a completely different digest. Trim whitespace on both inputs and ensure both sources are UTF-8 before comparing.

Which algorithm should I choose for file checksums today?

SHA-256 is the practical default — fast, universally supported, and collision-resistant. Use MD5 or SHA-1 only when you must match a checksum published in that format; they are fine for accidental-corruption checks but must not be used where an attacker could substitute a malicious file.

Troubleshooting & Technical Tips

Hash value differs every time: Salt and encoding differences

Cryptographic hash functions are deterministic — the same input always produces the same hash. If you are getting different results, there are invisible differences in the input text: a trailing space or newline (\n) character, different character encoding (UTF-8 vs UTF-16), or a BOM (Byte Order Mark). Additionally, some systems automatically add a Salt (random prefix); in that case hash = H(salt + password), so a different output each time is the expected behavior. For pure hash verification, paste your text into this tool to generate an unsalted hash.

Hash comparison fails: Case and encoding inconsistency

SHA hashes are displayed as hexadecimal strings. Some systems use uppercase (A-F) while others use lowercase (a-f) — when comparing two hashes, convert both to the same case using toLowerCase(). Also, some tools output hashes in Base64 format, while this tool uses hexadecimal (hex) format. Before comparing, make sure both sides use the same output encoding (hex vs Base64).

Web Crypto API not supported: SecurityError or undefined

The Web Crypto API (crypto.subtle) only works in secure contexts (HTTPS or localhost). On pages accessed via HTTP, crypto.subtle returns undefined and hash generation fails. Additionally, some older browsers (like IE 11) do not support the Web Crypto API at all. Since our site is served over HTTPS, you will not encounter this issue here. However, if you are computing hashes in your own projects, verify that your page is running in a secure context.

Related Guides

GUIDE

Web Security: Encoding and Hashing Guide

Encoding vs hashing vs encryption: when to use Base64, SHA-256, bcrypt, AES, and HTML entity encoding for web security — with examples and decision trees.

Verify a File's SHA-256 Checksum

What a checksum is, how to verify a file's SHA-256 hash on macOS, Windows, and Linux, what it catches, and the limit of trusting a published hash.

Are Online Password Generators Safe? What Client-Side Really Means

Is a web password generator safe? It comes down to one thing: is the password created in your browser or on a server? How to tell, and why it matters.

Password Hashing in 2026: Argon2 vs bcrypt vs scrypt vs PBKDF2

How to store passwords securely: compare Argon2id, bcrypt, scrypt, and PBKDF2, understand salts, peppers, and work factors, and what OWASP recommends.

Related Tools

Base64 Encoder / Decoder

Encoding & Decoding Tools

UUID Generator

Generator Tools

Password Generator

Generator Tools

Chmod Calculator

Generator Tools

TOTP / 2FA Generator

Generator Tools