Hash Generator
Generate SHA-256, SHA-1, and SHA-512 hashes locally — no data leaves your browser
Input Text
Privacy Note
All hashing is performed locally in your browser using the Web Crypto API. No text or hash values are transmitted to any server.
Hash Values
SHA-256
—
SHA-1
—
SHA-512
—
MD5
—
About Cryptographic Hashes
A hash function converts any input into a fixed-length string. The same input always produces the same hash (deterministic), but even a single character change completely changes the output (avalanche effect). Hashes are one-way — you cannot recover the original from the hash.
SHA-256 is the current standard for most security applications (TLS, Bitcoin, code signing). SHA-1 is deprecated for security but still used for checksums. SHA-512 offers higher security. MD5 is broken for security but still used for non-security checksums. This tool uses the browser's built-in Web Crypto API.
lightbulb Example
Input: "hello"
1SHA-256: 2cf24dba5f...
2Any change → completely different hash
✓ Use SHA-256 for all security needs
quizFrequently Asked Questions
What is the difference between MD5, SHA-1, and SHA-256?
MD5 produces a 128-bit hash and SHA-1 a 160-bit hash — both are considered cryptographically broken and should not be used for security. SHA-256 (part of the SHA-2 family) produces a 256-bit hash and is still considered secure. Use SHA-256 or SHA-512 for any security-sensitive purpose; MD5/SHA-1 are only acceptable for non-security checksums.
Can I reverse a hash to get the original text?
No. Hashing is a one-way function — it is computationally infeasible to reverse a hash to its input. This is by design. However, precomputed rainbow tables can reverse common inputs like passwords. This is why passwords must be salted before hashing — a unique random value appended to each password prevents rainbow table attacks.
What is a hash used for in software development?
Data integrity verification (file checksums), password storage (store hash, not plaintext), digital signatures (hash + encrypt with private key), content addressing (Git uses SHA-1 to identify commits), and deduplication (identical files have identical hashes). Never use an unsalted hash for password storage — always use bcrypt, argon2, or PBKDF2.