Generate SHA-1, SHA-256, SHA-384, and SHA-512 cryptographic hashes of any text or file. Uses the browser's native Web Crypto API — nothing is uploaded to any server.
Free, no sign-up — one of the SaaSQuickStart Privacy & Security tools.
Hashes are computed using the browser's built-in crypto.subtle.digest() API, which is implemented natively by the JavaScript engine and uses the platform's cryptographic library (OpenSSL on most platforms). Text is UTF-8 encoded via TextEncoder before hashing. File contents are read as ArrayBuffer via the File API. All four algorithms run in parallel using Promise.all(). Nothing is transmitted to any server at any point.
Both are part of the SHA-2 family and are considered secure. SHA-256 produces a 256-bit (64 hex char) digest and is faster on 32-bit systems. SHA-512 produces a 512-bit (128 hex char) digest and is faster on 64-bit systems due to its use of 64-bit operations. For most applications, SHA-256 is sufficient.
SHA-1 has known collision vulnerabilities — researchers demonstrated a practical collision (two different inputs producing the same hash) in 2017, costing roughly $75,000 in cloud compute. It is no longer acceptable for digital signatures or certificate fingerprints, though it remains safe for non-security uses like checksums.
Yes. Switch to the file upload tab, drop your downloaded file, then compare the SHA-256 hash shown here with the hash published on the download page. If they match exactly (every character), the file was not tampered with in transit.
No. SHA-256 and SHA-512 are too fast for password hashing. A GPU can compute billions of SHA-256 hashes per second, making brute-force feasible. For passwords, use dedicated slow-hashing algorithms: bcrypt, scrypt, or Argon2id. These are available in every modern backend framework.