Can a hash be reversed?

Not by computation. But a short or common input can be found by guessing — every dictionary word has a published SHA-256. A hash protects a value only when the value is unpredictable.

Is MD5 or SHA-1 available?

No, deliberately. Both are broken for anything security-related: two different inputs can be made to produce the same hash. Offering them invites their use in exactly the situations where they fail.

Which algorithm should I use?

SHA-256 unless something specifies otherwise. SHA-384 and SHA-512 are longer and no more suitable for passwords; on 64-bit hardware SHA-512 is often slightly faster, which is rarely the deciding factor.

Does my text leave the browser?

No. The Web Crypto API runs locally, so text you paste here is never transmitted.

Hash Generator

Computes SHA-256, SHA-384 and SHA-512 hashes of text in your browser, using the platform's own crypto implementation rather than a reimplementation.

Runs in your browser — nothing is uploaded

Input

Algorithm

MD5 is not offered. Browsers don't implement it, and it has been broken for years — if something still asks for MD5, that is worth questioning rather than working around.

Digest

Your hash appears here.

Need this as an API?

Why use it

Built to be genuinely useful

The browser's own implementation

Hashing goes through the Web Crypto API, so the result is the same one your language's standard library would produce.

Byte-exact

Text is hashed as UTF-8. A trailing newline or a non-breaking space changes the hash, which is the point — and a common surprise when comparing against a value computed elsewhere.

Nothing is uploaded

It runs in your browser. Tokens, keys and customer data routinely end up in these tools, and none of it should have to cross a network to be decoded.

Free, no sign-up

No account, no daily cap, and no feature held back behind a paywall.

How it works

Three steps

1
Paste the text.
2
Pick the algorithm.
3
Copy the hash.

A hash is not a password store

SHA-256 is designed to be fast, which is exactly the wrong property for storing passwords. A modern graphics card computes billions of SHA-256 hashes a second, so a leaked table of hashed passwords is a table of passwords with a delay attached.

Password storage needs a function designed to be slow and memory-hard — bcrypt, scrypt or Argon2 — with a per-user salt. Those exist specifically to make the guessing attack expensive. Using a general-purpose hash instead is the most common serious mistake in this area, and it is not fixed by hashing twice.

What SHA-256 is genuinely good for is checking that data has not changed: verifying a download, detecting a modified file, building a content address. In those uses, speed is a benefit.

Why your hash does not match theirs

Almost always whitespace. A file ends with a newline; a copied string does not. A text box adds a carriage return on Windows and not on macOS. Any of those changes every byte of the output, because that is what a hash function is supposed to do.

The second cause is encoding. The same characters hashed as UTF-8 and as UTF-16 produce different results, and a system that stores text in one and hashes in another will disagree with itself. This page hashes UTF-8, which is what nearly everything else does.

FAQ

Questions people ask

API access

Need Hash Generation in Your Application?

Integrate hash generation directly into your application, backend or build pipeline through API access.

Tell us what you are building, how you plan to use it and the volume you expect. We will come back to you with availability, integration details and a quote for your usage.

Related tools

More developer tools

Available tools are linked; the rest are in development.

Base64 Encoder Base64 Decoder URL Encoder URL Decoder JWT Decoder AI Writer AI Summarizer AI Paraphraser AI Humanizer AI Grammar Checker AI Rewriter AI Translator

All Developer Tools

Need a tool like this for your business?

We build internal tools, dashboards and automation that fit how your team works.

See Our Services