Hash Generator

Runs entirely in your browser

Hashing uses the Web Crypto API built into your browser. The text never leaves the page, which means you can safely hash something sensitive — unlike most online hash tools, which post your input to a server.

Which algorithm to use

• SHA-256 — the sensible default for integrity checks, file verification and general use.
• SHA-384 / SHA-512 — longer digests. Use where a standard or compliance requirement specifies them.
• SHA-1 — shown because you will still meet it: certificate thumbprints, git object IDs, legacy integrity checks. Collision attacks against it are practical and demonstrated. Never use it for new signatures or anything security-bearing.
• MD5 — deliberately not offered. It is thoroughly broken and there is no good reason to generate a new one.

Hashes are not password storage

This is the mistake worth naming plainly. A bare hash — SHA-256 included — is the wrong way to store passwords, because it is designed to be fast, and fast is exactly what an attacker with a stolen database wants. Modern hardware runs billions of SHA-256 operations per second.

Password storage needs a deliberately slow, salted key-derivation function: Argon2id, scrypt or bcrypt. If you are looking at an application that stores sha256(password), that is a finding, not a design.

What hashes are good for

Verifying a download matches what the publisher published. Detecting whether a file changed. Deduplicating content. Building content-addressed storage. In every case the property you want is that the same input always gives the same output, and a different input essentially never does.

If you are assessing where hashing is used across an application or environment, that is security auditing territory.