Hash Generator

How to use the Hash Generator

1. Type or paste the text you want to hash into the input box.
2. Click Generate Hashes to compute SHA-1, SHA-256, and SHA-512 simultaneously.
3. Click Copy next to any algorithm to copy the hash to your clipboard.

What is a cryptographic hash?

A cryptographic hash function takes any input, a word, a file, a message, and produces a fixed-length, deterministic output called a digest or hash. Key properties:

• Deterministic: the same input always produces the exact same hash
• One-way: you cannot reverse a hash to recover the original input
• Avalanche effect: changing even one character produces a completely different hash
• Fixed length: regardless of input size, the output is always the same length for a given algorithm

SHA-1 vs SHA-256 vs SHA-512

SHA-1 produces a 160-bit (40 hex character) digest. It was the standard for over a decade but is no longer considered cryptographically secure. Collision attacks have been demonstrated, meaning two different inputs can produce the same hash. Do not use SHA-1 for digital signatures, certificates, or password storage.

SHA-256 produces a 256-bit (64 hex character) digest. It is part of the SHA-2 family and is the current standard for most security applications, including TLS certificates, code signing, Bitcoin, and HMAC.

SHA-512 produces a 512-bit (128 hex character) digest. It offers higher security margin and is faster than SHA-256 on 64-bit processors. It is used in applications requiring very strong collision resistance.

Common use cases

• File integrity: verify that a downloaded file has not been corrupted or tampered with by comparing its hash to the one published by the provider
• Password storage: systems store the hash of a password, never the password itself (use bcrypt or Argon2 for this, not raw SHA)
• Data deduplication: identify duplicate files by their hash instead of comparing content byte by byte
• API authentication: HMAC uses SHA-256 to sign API requests and verify they have not been modified in transit
• Checksums: compare hashes to ensure configuration files, backups, or build artifacts are identical

Privacy

All hashing uses the browser's built-in Web Crypto API. No text is sent to any server.

SHA-256 is wrong for passwords, use Argon2 or bcrypt

A common mistake is using SHA-256 to hash passwords. SHA and its variants are designed to be fast, they can compute billions of hashes per second on a GPU. That makes them useless for password storage, where you want hashing to be slow.

For passwords, use a purpose-built, slow algorithm:

• Argon2id: Winner of the Password Hashing Competition (2015). Recommended by NIST SP 800-63B and OWASP. Memory-hard, resistant to GPU and ASIC attacks.
• bcrypt: Widely supported, adjustable cost factor. Still considered strong for most applications.
• scrypt: Memory-hard, used by some cryptocurrency wallets and Linux systems.

The NCSC (National Cyber Security Centre, UK) guidance states that bcrypt, scrypt, and Argon2 are acceptable for password hashing. SHA-2 (including SHA-256) is explicitly listed as unsuitable for this purpose. In France, the ANSSI recommends Argon2id as the first choice for new systems.