Hash Generator

What a hash is

A hash function turns any input into a fixed-length string of characters. The same input always produces the same hash; a different input essentially never produces the same one.

Change one character of the text above and every character of the output changes. That property — the avalanche effect — is what makes hashes useful for detecting whether something has been altered.

It only goes one way

You cannot reverse a hash. There is no decode button here because there is no decoding to do: the function throws information away, and a hash of a thousand-page document is the same 64 characters as a hash of one word.

What attackers do instead is guess: hash millions of candidate inputs and look for a match. Against common passwords that works extremely well, which is why a plain hash is not sufficient for storing them.

Which algorithm

• SHA-1 — 160 bits, and broken. Practical collisions were demonstrated in 2017. Still found in old systems and in Git's internals, but it should not be chosen for anything new that depends on security.
• SHA-256 — 256 bits, the sensible default. Used throughout TLS, code signing and Bitcoin.
• SHA-384 and SHA-512 — longer variants. SHA-512 is often faster than SHA-256 on 64-bit hardware, because it works in 64-bit words.

MD5 is not offered. It has been thoroughly broken since 2004 and browsers do not implement it in their cryptography API, which is a reasonable decision.

Do not use these for passwords

SHA functions are designed to be fast, and speed is precisely what you do not want when storing passwords. A modern graphics card can compute billions of SHA-256 hashes a second, so a fast hash of a human-chosen password falls quickly.

Password storage needs a deliberately slow, memory-hard function — Argon2, scrypt or bcrypt — with a unique random salt per password. Those are tuned to take a meaningful fraction of a second each, which makes mass guessing impractical.

Where hashes are genuinely the right tool

• Verifying a download against a published checksum.
• Detecting whether a file has changed, which is how Git tracks content.
• Deduplication — identical content hashes identically.
• Digital signatures, which sign a hash rather than a whole document.

How this works

The hashing uses the browser's built-in Web Crypto API, the same implementation the browser uses for TLS. Your text never leaves the page, which is worth caring about given that people routinely paste secrets into hash tools hosted by strangers.

Questions people ask

Can a hash be reversed?

No. The function discards information. Attackers guess instead, hashing candidate inputs and looking for a match.

Which hash should I use?

SHA-256 for almost anything. SHA-1 is broken and should not be chosen for new work.

Why is MD5 not offered?

It has been thoroughly broken since 2004, and browsers do not implement it in their cryptography API.

Can I use SHA-256 to store passwords?

No. SHA functions are fast by design, and a graphics card computes billions a second. Use Argon2, scrypt or bcrypt with a unique salt.

Is my text sent to a server?

No. It is hashed by your browser's own Web Crypto API, the same one used for TLS.

Your text stays in the page

This matters more here than on most tools. People paste API keys into hash generators, customer data into CSV converters, contract wording into diff checkers and configuration into JSON validators. Almost every site offering these sends your input to a server to process it.

Nothing here is transmitted. The work happens in your browser, this site is static files with no server behind it, and the about page lists every request the site makes, read live from your own browser so you can check rather than trust.