Generate SHA Hashes Online

A hash function turns any input into a fixed-length fingerprint. The same input always gives the same hash, and a tiny change gives a completely different one. Hashes are used to verify data integrity and to build signatures.

This tool computes SHA-1, SHA-256, SHA-384 and SHA-512 using the Web Crypto API built into your browser.

Key features

• SHA-1, SHA-256, SHA-384 and SHA-512
• Show one algorithm or all at once
• Lowercase or uppercase hex output
• Updates as you type

SHA-256 of "hello"

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

How to use

1. Type or paste your text.
2. Choose an algorithm, or All.
3. Copy the hash.

Use cases

• Checking that two pieces of text are identical
• Producing test vectors for integrations
• Generating fingerprints for cache keys

In depth

A cryptographic hash maps input of any size to a fixed-size digest. SHA-256 gives 256 bits, shown as 64 hexadecimal characters, SHA-384 gives 96 characters and SHA-512 gives 128 characters. Good hashes are deterministic, fast, and designed so that finding an input from a digest, or finding two inputs with the same digest, is computationally infeasible. Changing a single character in the input changes about half of the output bits, known as the avalanche effect.

SHA-1 and the SHA-2 family are defined in NIST FIPS 180-4. SHA-1 has been broken for collision resistance, with practical collisions demonstrated in 2017, so it should not be used for signatures or certificates. Fast general hashes are also a poor choice for storing passwords because attackers can try billions of guesses per second. Use a slow, salted algorithm such as bcrypt, scrypt or Argon2 for that purpose. Also remember that hashes are computed over bytes, so the text encoding affects the result.

Tips

• When comparing against a published checksum, check that you hashed exactly the same text. A trailing newline or a space changes the digest completely, and this is the commonest reason for a mismatch.
• This tool hashes text typed into the box. A checksum of a downloaded file is computed from the file bytes, so hashing the file name or pasted contents will not give the published value.
• Choose SHA-256 as the default for new work. Use SHA-512 if a specification asks for it, and keep SHA-1 only to match legacy systems that still require it.

Related tools

• Base64 Encode and Decode Encode text to Base64 or decode Base64 back to text.
• HTML Entities Encode and Decode Escape or unescape HTML special characters and entities.
• JSON String Escape and Unescape Escape text for use inside a JSON string, or unescape it.
• JWT Decoder Decode a JSON Web Token and read its header and payload.
• Text to Binary, Hex and Decimal Convert text to binary, hex, decimal or octal and back.
• URL Encode and Decode Percent-encode or decode URLs and query string values.