What is a Hash Generator?
A cryptographic hash function takes any input — a word, a file, a whole document — and produces a fixed-length string of characters (the hash, or digest) that's unique to that exact input. Change even one character of the input and the entire hash output changes completely and unpredictably. Hashing is one-way: you can't reverse a hash back into the original text, which is exactly what makes it useful for verifying data integrity and, with proper additional steps, storing passwords without keeping the plaintext.
When to use it
Hashes are used to verify a downloaded file wasn't corrupted or tampered with (comparing the published SHA-256 checksum against the one you compute locally), to generate a consistent cache key or content fingerprint for a piece of text, and to check whether two pieces of text are identical without comparing them character by character. This tool is not for hashing passwords for storage — for that specific case, use the dedicated bcrypt tool, since general-purpose hash functions like SHA-256 are deliberately fast, which makes them unsuitable for password storage where you actually want hashing to be slow.
How it works
This tool calls crypto.subtle.digest(), part of the browser's built-in Web Crypto API, which computes the hash using the same underlying algorithms (SHA-1, SHA-256, SHA-384, SHA-512) as any server-side implementation — there's no custom or simplified hashing logic here, so results match exactly what you'd get from command-line tools like sha256sum or a backend language's crypto library. The text is first encoded to UTF-8 bytes, then digested, then the resulting bytes are converted to a lowercase hexadecimal string, which is the standard way hash digests are displayed.
Frequently asked questions
Which hash algorithm should I use — SHA-1, SHA-256, or SHA-512?
SHA-1 is considered cryptographically broken and shouldn't be used for security purposes anymore, though it still appears in some legacy systems. SHA-256 is the current standard for most use cases (file checksums, Git commit hashes, general integrity checks). SHA-512 offers a larger output and is used where slightly higher security margins matter, at a small performance cost.
Why isn't MD5 included in this tool?
MD5 isn't supported by the browser's built-in Web Crypto API, and it's also cryptographically broken — collisions (two different inputs producing the same hash) have been demonstrated in practice, so it shouldn't be relied on for security-sensitive uses regardless.
Can I use a SHA-256 hash to store user passwords?
Not safely on its own. General-purpose hashes like SHA-256 are fast by design, which means an attacker with a leaked hash database can try billions of password guesses per second. Password-specific algorithms like bcrypt are deliberately slow and include salting, which is why they're the correct choice for password storage — this site has a dedicated bcrypt tool for that.
Will hashing the same text twice always produce the same result?
Yes — hash functions are deterministic. The exact same input will always produce the exact same output hash, which is precisely what makes them useful for verifying that two pieces of data are identical.