Hash Generator

A hash function converts input into a fixed-length digest. SHA digests can help verify file integrity, address content, or detect duplicates. Do not store passwords with a raw SHA hash from this tool. Password storage requires a unique salt and a password-hashing function such as Argon2id, scrypt, or bcrypt with an appropriate work factor.

SHA-256 is a widely supported default when a protocol calls for a general-purpose SHA-2 digest. A digital-signature scheme or HMAC is a separate construction whose protocol specifies the hash and key handling. Use SHA-384 or SHA-512 when that protocol or a requirement calls for them. Avoid SHA-1 for new collision-resistance work. NIST recommends SHA-2 or SHA-3 for new applications.

Google's SHAttered project (2017) produced two different PDF files with the exact same SHA-1 hash, proving practical collision attacks are possible. A collision breaks the guarantee that a hash uniquely identifies its input, which undermines signatures and integrity checks. SHA-1 is still used in Git for object addressing (not security), but avoid it anywhere authenticity matters.

No. Hashing is a one-way operation, and there is no algorithm to recover the original text from the output. Attackers get around this for short or common inputs by precomputing a table of known hashes (a rainbow table) and looking yours up. That is why passwords need a unique random salt and a deliberately slow algorithm like bcrypt or Argon2 before hashing.

No. All hashing runs locally in your browser using the Web Crypto API (SubtleCrypto.digest). Your text never leaves your device, and no network request is made.