SHA-256 Hash Generator — Free, In Your Browser
Hash a string with SHA-256 and three of its relatives.
Runs on your device What you paste is processed by your own browser. It is never sent to a server, and it is not stored anywhere after you leave the page.
Short answer
A SHA-256, SHA-1, SHA-384 or SHA-512 hash of any text can be produced for free in a web browser. The text is encoded as UTF-8 and passed to the browser's own Web Crypto implementation, the same audited code used for TLS, and the digest is shown as hexadecimal in upper or lower case. The hashing happens on the device, so the text being hashed is never transmitted.
At a glance
| Accepts | Any text |
|---|---|
| Produces | Hexadecimal digest |
| Processing | In your browser |
| Price | Free, no limits |
| Account | Not required |
A hash is a one-way fingerprint: the same input always produces the same digest, and the digest cannot be turned back into the input. That makes it useful for comparing two things without revealing either, for checking that a download matches the checksum its publisher listed, and for spotting whether a file or a string has changed.
SHA-256 is the right default and the one to reach for unless something else is specified. SHA-1 is here because plenty of existing systems still emit it — Git object ids among them — but it has been demonstrably vulnerable to collisions since 2017 and must not be chosen for anything new that depends on two different inputs never colliding.
How to use it
- 1
Paste your text
A password to compare, a string to fingerprint, a message to check.
- 2
Pick the algorithm
SHA-256 unless you have been told otherwise. SHA-1 only for compatibility with something that already uses it.
- 3
Convert
The hexadecimal digest appears below, computed by the browser's own crypto implementation.
- 4
Copy the digest
Copy it to the clipboard, or download it as a text file.
Frequently asked questions
Is my text sent anywhere to be hashed?
No. The Web Crypto API is built into your browser, so the digest is computed on your device and neither the input nor the result is transmitted.
Can a hash be reversed?
Not directly — that is what makes it a hash. But a short or common input can be found by trying candidates until one matches, which is why a bare hash of a password is not password storage. Use a purpose-built function such as bcrypt or Argon2 for that.
Why is MD5 not offered?
Because the browser's crypto implementation does not include it, so offering it would mean shipping a separate implementation of a function that has been broken since 2004. Anything checking a modern checksum wants SHA-256 instead.
Should I still use SHA-1?
Only where something existing requires it. Practical collision attacks against SHA-1 have been public since 2017, so nothing new should depend on it for integrity or signatures.
The tool says my browser cannot run it. Why?
The Web Crypto API is only exposed on a secure connection. Over plain http — or on some hardened or very old browsers — it is absent, and the hash cannot be computed at all.