How to generate a SHA hash
- Type or paste your text into the box. There is no button to press; the digests refresh about 0.2 seconds after you stop typing.
- Read the SHA-1, SHA-256 and SHA-512 digests, each shown as lowercase hexadecimal.
- Click Copy beside the one you need. Compare it character by character, or paste both values into a diff tool, against the hash you expect.
What is a SHA hash?
A hash function turns any input into a fixed-length fingerprint called a digest. The same input always gives the same digest, but even a one-character change produces a completely different result. That makes hashes ideal for verifying downloads, detecting duplicate data and building tamper-evident records. Hashing is one-way: you cannot compute the original text from its digest, you can only hash a guess and compare.
Real examples to check the tool against
These published test vectors are handy for confirming that your own code or another tool agrees. For the three-letter input abc:
- SHA-1:
a9993e364706816aba3e25717850c26c9cd0d89d(40 hex characters, 160 bits) - SHA-256:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad(64 hex characters, 256 bits) - SHA-512:
ddaf35a193617aba…a54ca49f(128 hex characters, 512 bits; the full value is shown in the tool)
Now change abc to Abc and all three digests change completely. That sensitivity is called the avalanche effect, and it is why a single flipped bit in a download is detectable.
Common reasons your hash does not match
- Trailing newline or space.
abcandabcfollowed by a line break are different inputs. On a command line,echo abc | sha256sumhashes four bytes because echo adds a newline, whileprintf abc | sha256sumhashes three. Use the second to match this tool. - Different encoding. This tool encodes text as UTF-8 before hashing. A string with accented letters or emoji gives a different digest if the other system uses UTF-16 or Latin-1.
- Line endings. Text typed into a browser box uses plain line feeds. A file saved on Windows with CRLF line endings hashes differently from the same text with LF.
- Uppercase hex. The digest is the same value, only written differently. Compare after lowercasing.
- Hashing a file, not its text. This tool hashes typed or pasted text only. It cannot take a file, so for a downloaded installer use your operating system's checksum command instead.
Which SHA should I use?
SHA-256 is the practical default: it is fast, universally supported and used in TLS certificates, code signing and Bitcoin. SHA-512 has a longer digest and is often faster than SHA-256 on 64-bit CPUs. SHA-1 is broken for security use: in 2017 researchers produced the first practical collision, two different PDFs with the same SHA-1 digest. Keep it for legacy compatibility or non-security checksums only. MD5 is not offered because the Web Crypto API this tool relies on does not implement it, and it has been collision-prone since 2004.
What a plain SHA hash is not for
Do not store passwords as a single SHA-256 digest. SHA is designed to be fast, so an attacker with a leaked table can test billions of guesses per second on a graphics card, and identical passwords produce identical hashes. Password storage needs a deliberately slow, salted algorithm such as Argon2, scrypt, bcrypt or PBKDF2. This page also does not compute HMAC (keyed hashes), which you need for signing API requests.
Is it private and safe?
Yes. The digests are computed by the browser's built-in Web Crypto API on your device, and your text is never uploaded. Because that API is only available on secure pages, the tool shows an error if your browser cannot provide it.
Related guides: SHA-256 hash explained, What is a UUID? and Why websites reject your password.
Frequently asked questions
Is my text uploaded to a server?
No. Hashes are computed with the Web Crypto API built into your browser, on your own device. Your text never leaves the page and nothing is logged.
Why is MD5 not supported?
The Web Crypto API deliberately leaves out MD5 because it is cryptographically broken and collisions can be created in seconds. Use SHA-256 for new work. If you must match an old MD5 checksum, use a command-line tool such as md5sum.
Can I reverse a hash back to the original text?
No. Hashing is a one-way function, so no calculation recovers the input. Attackers instead hash many guesses and look for a match, which is why short or common inputs can still be discovered.
Why does my hash differ from the one in my terminal?
The most common cause is a trailing newline. The echo command adds one, so echo abc and the text abc are different inputs. Use printf with no newline, and make sure both sides use UTF-8 and the same line endings.
Can I hash a file with this tool?
Not directly. It hashes the text you type or paste, encoded as UTF-8. To checksum a downloaded file, use certutil -hashfile on Windows or shasum -a 256 on macOS and Linux.
Is SHA-256 safe for storing passwords?
Not on its own. It is too fast and has no salt, so stolen hashes can be guessed at enormous speed. Use a purpose-built password hashing function such as Argon2, scrypt or bcrypt instead.
What do the hash lengths mean?
SHA-1 produces 160 bits, shown as 40 hexadecimal characters. SHA-256 produces 256 bits, shown as 64 characters, and SHA-512 produces 512 bits, shown as 128 characters. Each hex character encodes four bits.
Is it free?
Yes. It is completely free with no sign-up and no limits.