Hash Generator (SHA-256 / SHA-1)
Generate a SHA-256 or SHA-1 hash from text or a local file using your browser's Web Crypto API. The hexadecimal digest appears instantly and can be copied with one click. Hashing runs on your device, with no upload and no account. Hashes are for integrity checks, not password storage.
Web Crypto is available over HTTPS and on localhost. Hashing a file reads it into memory; very large files can be slow.
How to generate a SHA-256 or SHA-1 hash in the browser
Type or paste text, choose SHA-256 or SHA-1, and press Generate hash. The result is a hexadecimal digest: 64 characters for SHA-256 and 40 for SHA-1. Press Copy hex to put it on the clipboard. To hash a file, pick one with the file control; the browser reads its bytes and passes them to crypto.subtle.digest without contacting a server. Changing the algorithm and pressing Generate again hashes the current text with the new choice, while choosing a file hashes the file immediately.
A cryptographic hash is a fixed-size fingerprint of the input. The same bytes always produce the same digest, and even a one-bit change produces a completely different result. Hashes are useful for checking that a download, backup, or message was not altered: compare the digest you compute with the digest published by the source. They are not encryption, because there is no key and no way to recover the original bytes from the digest alone. For confidentiality, use authenticated encryption such as AES-GCM.
SHA-256 is still considered secure for integrity and signature work. SHA-1 is offered only for compatibility with old checksums and existing systems; it is broken for collision resistance, and attackers have produced different inputs with the same SHA-1 digest. Do not choose SHA-1 for new security designs. MD5 is deliberately absent because browsers do not expose it through Web Crypto and it is unsuitable for security.
Never use a general-purpose hash to store passwords. Fast hashes let an attacker test billions of guesses per second. Use a dedicated password hash such as Argon2id, scrypt, or bcrypt with a unique per-user salt and a work factor tuned to your hardware. Also remember that hashes are byte-sensitive: trailing spaces, Windows versus Unix line endings, a byte order mark, or a different character encoding all change the digest. Compare the exact bytes and the exact algorithm.
FAQ
What is the difference between hashing and encryption?
A hash is a one-way fingerprint of the input and cannot be reversed. Encryption is reversible with a key. Use a hash for integrity checks and encryption when you need to recover the original data.
Is SHA-256 safe to use?
SHA-256 is widely used and still considered secure for integrity checks and signatures. SHA-1 is considered broken for collision resistance and should not be used for new security work.
Can I use this to store passwords?
No. General-purpose hashes are too fast for password storage. Use a dedicated password hash such as Argon2id, scrypt, or bcrypt with a unique salt and appropriate work factors.
Why do I get a different hash for the same-looking text?
Hashes are sensitive to every byte. A trailing space, a different line ending, a byte order mark, or a different text encoding produces a completely different digest. Compare the exact bytes, not the visible text.
Does hashing a file upload it?
No. The file is read into memory by your browser and passed to crypto.subtle.digest. Nothing is sent to a server. Very large files may take a moment and use a lot of memory.
Why is MD5 missing?
The Web Crypto API in browsers does not provide MD5, and MD5 is broken for security purposes. This tool intentionally supports only SHA-256 and SHA-1.