This hash generator computes SHA-256, SHA-384, SHA-512, SHA-1 and MD5 in your browser, and shows the byte count beside the digest — because that is usually what differs when two digests do not match.
What a hash generator does
A hash generator turns any input into a fixed-length fingerprint. The same bytes always give the same digest, a single changed byte gives a completely different one, and there is no way back to the input.
One byte changes everything
Ask a hash generator for SHA-256 of hello and then of hellp and the two digests have nothing visibly in common. That is the avalanche property, and it is what makes a hash useful for spotting changes.
It is also why a digest is useless as a summary. You cannot tell from two digests whether the inputs were similar or completely unrelated.
What a hash generator is actually used for
- Integrity — checking a download matches the checksum the publisher printed.
- Identity — naming a piece of content by its digest, the way Git names objects.
- Signatures — signing the digest rather than the whole document.
All three depend on the digest being reproducible. None depends on it being secret, which is why a hash generator can run entirely in your browser with nothing to hide.
Why your digest does not match
It is nearly always the bytes
When somebody says the hash is wrong, the algorithm is almost never at fault. Any two implementations of SHA-256 agree, always. What differs is what went into them.
The text abc hashes to ba7816bf and so on. Adding a trailing newline makes it four bytes and changes the digest completely to edeaaff3. Adding a trailing space also makes it four bytes and gives a third digest, 5488613c. The word café written with a precomposed e-acute is five bytes and hashes to 850f7dc4, while the same word written as e followed by a combining accent is six bytes and hashes to 81ef060b, even though the two look identical on screen.
The trailing newline
The single most common cause. echo abc | sha256sum hashes four bytes, not three, because echo adds a newline that a hash generator on a web page never sees you type. Use printf or echo -n and the digests line up.
This hash generator prints the byte count next to your text and says so explicitly when the input ends in a newline.
The same word, written two ways
The subtler one. The é in café is either a single code point or ane followed by a combining accent, depending on the keyboard, the operating system and where the text was copied from.
Those are five bytes and six bytes. They render identically and hash to unrelated digests, and nothing on screen tells you which one you have — so a hash generator that stays quiet about it is leaving you to guess.
So this page checks
When the text is not in the usual Unicode form, a notice appears with both byte counts and an offer to normalise. No other hash generator found in this category does that, and it is the kind of thing that costs an afternoon when it bites.
Which algorithm to pick
SHA-256, SHA-384 and SHA-512 are current and suitable for signatures, integrity checks and content addressing. SHA-1 is broken: in 2017 researchers at CWI and Google produced two different PDF files with the same SHA-1 digest, at a cost of roughly nine quintillion SHA-1 computations. MD5 is broken further: RFC 1321 estimated that a collision would take 2 to the 64 operations, and collisions have been produced on ordinary hardware since 2004. None of the five is suitable for storing passwords, because all of them are fast by design and password storage needs a function that is deliberately slow.
SHA-256 unless something says otherwise
It is what this hash generator starts on, and the right answer almost every time. SHA-384 and SHA-512 exist because some specifications name them, and because SHA-512 is faster on 64-bit hardware despite the longer digest.
No collision has ever been produced against any of the three, which is more than can be said for the two a hash generator has to keep around for compatibility.
Why the broken ones are still offered
SHA-1 fell in February 2017, when researchers at CWI Amsterdam and Google published two different PDF files sharing one digest. It cost roughly nine quintillion SHA-1 computations — expensive, but done, and cheaper every year.
MD5 is further gone. RFC 1321 estimated that finding a collision would take 2⁶⁴ operations; collisions have been produced on ordinary hardware since 2004.
Verifying an old checksum is a real job
Both are still here because checking a download against a digest somebody published in 2011 is something people genuinely need to do. A hash generator that refused on principle would just send you to a worse one.
They are labelled, and the label says what broke them rather than only that something did. Never choose either where an attacker gets to pick the input.
Not for passwords
Fast is the wrong property
Every algorithm in this hash generator is designed to be quick, and a graphics card will compute billions of SHA-256 digests a second. That is what you want for checking a download and exactly what you do not want between an attacker and a stolen password database.
A password hash has to be slow on purpose. bcrypt, scrypt and Argon2 are built to cost a measurable amount of time and memory per guess, and that cost is the whole point.
Salting does not fix it
Adding a salt stops one precomputed table serving every account, which is worth having. It does nothing about speed, so the attacker still gets their billions of guesses a second — just per account instead of all at once.
Use a function designed for the job. All three of them generate and store their own salt, so there is nothing extra to wire up.
What to use instead
For storing passwords, bcrypt or Argon2 in whatever your language provides. For generating one, the password generator; for checking one you already have, the strength checker, which keeps what you type in the page exactly as this hash generator does.
Frequently asked questions
Why does my digest not match the one I was given?
Almost always the bytes rather than the algorithm. A trailing newline is the usual culprit: echo abc | sha256sum hashes four bytes, not three, because echo adds one. A trailing space does the same and is invisible. This tool prints the byte count so you can see which you hashed.
Two people typed the same word and got different hashes. How?
Accented characters can be written two ways. The é in café is either one code point or an e followed by a combining accent, and the two are different byte sequences that hash differently while looking identical. This page detects that and offers to normalise before hashing.
Can I hash a password with SHA-256?
You can, and you should not. SHA-256 is fast by design — billions of guesses a second on a graphics card — and a password hash needs to be slow on purpose. Use bcrypt, scrypt or Argon2, all of which handle the salt for you as well.
Why is MD5 still here if it is broken?
Because checking a download against a checksum somebody published in 2011 is a real task, and refusing to help with it would just send you to a worse tool. It is labelled, and it is never a reasonable choice for anything where an attacker gets to pick the input.
How broken is SHA-1, exactly?
In February 2017 researchers at CWI Amsterdam and Google published two different PDF files with the same SHA-1 digest. It took roughly nine quintillion SHA-1 computations, so it is not free — but it is done, and it only gets cheaper. Treat SHA-1 as something you read, never something you newly rely on.
Is my text sent to a server?
No. SHA hashing uses crypto.subtle.digest, which is built into your browser; MD5 uses a small implementation bundled into the page. Nothing you type is transmitted, stored, put in the URL or attached to an analytics event. Disconnect from the internet and the tool keeps working.
Why does the Hex input mode give a different result?
Because it hashes different bytes. In Text mode, typing 616263 hashes six characters — the digits themselves. In Hex mode it hashes the three bytes 0x61 0x62 0x63, which is the text abc. Pick the mode that matches what you actually have.
Can I hash a file?
Not on this page. It takes text, which covers checking a string against a published digest and understanding how hashing behaves. For a file, your operating system already has the tool: shasum -a 256 on macOS and Linux, Get-FileHash in PowerShell.
More free generators
Like this hash generator, every tool here runs locally in your browser, with no account and no limits.
Password Tools
Random Generators
Keys & Secrets
Methodology
Last updated
Where the hashing happens
SHA-1, SHA-256, SHA-384 and SHA-512 go to crypto.subtle.digest(), your browser's own implementation, so most of this hash generator is code you already trust. Nothing you type is transmitted, written to storage, placed in the URL or attached to an analytics event. Disconnect from the internet and it keeps working.
The one algorithm written by hand
Web Crypto deliberately does not implement MD5, so this page bundles a small implementation of it. Writing a hash function yourself normally deserves suspicion.
Which is why the unit tests run all seven vectors from RFC 1321's own test suite, plus the block-boundary lengths where the padding rules change. If any of them fails, the build stops.
How the byte count is worked out
The text is encoded to UTF-8 and the bytes counted, which is what the hash actually consumes. The character count beside it counts what a reader sees, so an emoji counts once even though it is four bytes. Hex and Base64 input modes count the decoded bytes instead.
The normalisation check
The input is compared with its Unicode NFC form. When they differ, both byte counts are shown and normalising is offered, but never applied on its own — changing what you typed before hashing it would be a strange thing for a hash generator to do without asking.
What this page does not do
Files, HMAC, and password hashing. A file digest is a job your operating system already does well, and putting bcrypt in a hash generator beside SHA-256 would suggest the two belong to the same category. They do not.