Hash Generator

A hash function converts any input into a fixed-length fingerprint: 40 hex characters for SHA-1, 64 for SHA-256, 96 for SHA-384, and 128 for SHA-512. Common uses include verifying file integrity (the downloaded file's hash must match the publisher's), storing passwords securely, generating short IDs, and detecting duplicate content without comparing files byte by byte.

SHA-256 is the right default for nearly everything: checksums, digital signatures, HMAC keys, and content addressing. Pick SHA-384 or SHA-512 if a spec or compliance requirement demands a larger output. Avoid SHA-1 for any new security work, since it is broken for collision resistance and flagged as deprecated by NIST.

Google's SHAttered project (2017) produced two different PDF files with the exact same SHA-1 hash, proving practical collision attacks are possible. A collision breaks the guarantee that a hash uniquely identifies its input, which undermines signatures and integrity checks. SHA-1 is still used in Git for object addressing (not security), but avoid it anywhere authenticity matters.

No. Hashing is a one-way operation, and there is no algorithm to recover the original text from the output. Attackers get around this for short or common inputs by precomputing a table of known hashes (a rainbow table) and looking yours up. That is why passwords need a unique random salt and a deliberately slow algorithm like bcrypt or Argon2 before hashing.

No. All hashing runs locally in your browser using the Web Crypto API (SubtleCrypto.digest). Your text never leaves your device, and no network request is made.