Security
SHA Hash Generator
Uses the browser's native digest implementation, so a multi-megabyte file is hashed locally in milliseconds — handy for verifying a download.
Hash appears here.
How to use it
- Paste text, or choose a file — picking a file hashes its bytes instead.
- Choose an algorithm. SHA-256 is the normal choice; SHA-1 survives for legacy checksums.
- Press Hash. Equal hashes only prove the inputs are byte-identical.
A hash is not encryption
Encryption is reversible with a key; hashing is not reversible at all. A hash is a fixed-length fingerprint, and the property you actually rely on is that finding any other input with the same digest is computationally infeasible. MD5 and SHA-1 no longer provide that. Practical collisions were demonstrated in 2004 and 2017 respectively, so neither should be used for signatures, certificates or integrity checks — even though both are still found in legacy systems.
Why a fast hash is the wrong tool for passwords
Speed is a liability here. A modern GPU tries billions of SHA-256 candidates per second, and precomputed rainbow tables cover the common passwords outright. Password storage therefore uses deliberately slow, memory-hard functions — bcrypt, scrypt, Argon2 — each with a per-user salt so identical passwords produce different digests. If you are storing passwords and reaching for SHA-256, replacing it is the single highest-value change available to you.
Verifying a download you already have
Publishers list a SHA-256 beside the file; hashing the file locally and comparing the two strings is the whole procedure. Compare the first and last eight characters rather than reading 64 hex digits — a mismatch is almost always at one end, and transcribing errors are more common than tampering.
MD5 and SHA-1 still appear on download pages, usually because nobody updated them. They are fine for spotting a corrupted transfer and useless for anything an attacker might care about: chosen-prefix collisions in MD5 cost a few dollars of GPU time.
Frequently asked questions
Can a hash be reversed?
No. A hash is a one-way fingerprint. You can only guess an input and hash it again.
Is SHA-1 still safe?
Not for signatures — collisions have been produced in practice. It survives in old checksums and git object IDs.
Why is the result always the same?
Deterministic by design: same bytes in, same digest out, on every machine. That is what makes hashes useful for verification.
Why do two tools give different MD5 for the same text?
Almost always a line-ending or encoding difference: one hashed the text with a trailing newline or as UTF-8 with BOM. Hash the exact bytes, not the visible characters.
Can a hash be reversed?
Not by design. What attackers do instead is guess inputs — which works because most passwords are guessable, not because the hash is weak.