What This Tool Does

This tool computes a SHA-256 or SHA-1 hash — a fixed-length fingerprint — of any text you enter, entirely in your browser. Hashes are used to verify that data hasn't changed (a file's hash before and after a transfer should match), to detect duplicates without comparing full contents, and as building blocks inside other security protocols.

How to Use It

Choose SHA-256 or SHA-1, type or paste your text into the input box, and click Generate Hash. Hashing runs asynchronously via the browser's Web Crypto API, so there's a brief "Hashing..." state while it computes — the result then appears below with a Copy button.

The Formula

Your text is first converted to raw UTF-8 bytes, then passed to the browser's native crypto.subtle.digest()— the Web Crypto API's built-in implementation of SHA-256 and SHA-1, with no external library involved. The resulting digest is a raw byte buffer, which is converted to the familiar lowercase hexadecimal string by mapping each byte to its two-digit hex representation.

A Worked Example

Hashing an empty input with SHA-256 always produces e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855— a well-known, widely documented reference value, since every implementation of SHA-256 must agree on the hash of the same input. Hashing the text "hello world" with SHA-256 produces b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9; changing even a single character of the input — a capital letter, an extra space — produces a completely different, unrelated-looking hash, which is exactly the property that makes hashes useful for detecting any change to data.

Important: What Hashing Is (and Isn't) Safe For

Hashing is one-way, not reversible.Unlike this batch's Base64 tool, there is no "decode" operation for a hash — you cannot take a SHA-256 or SHA-1 output and recover the original input from it. A hash is a fingerprint of the data, not a reversible encoding of it.

SHA-1 is cryptographically broken for security purposes.Researchers have demonstrated practical collision attacks against SHA-1 (two different inputs producing the same hash), so it must not be relied on anywhere security matters — digital signatures, certificate fingerprints, or anything where an attacker might deliberately try to forge a matching hash. It remains fine for basic, non-adversarial checksums, like confirming a file wasn't accidentally corrupted in transfer.

Never use plain SHA-256 or SHA-1 to store passwords. Hashing a password directly and storing the result is not secure practice, even with SHA-256. General-purpose hash functions are deliberately fast — exactly the wrong property for password storage, since it makes brute-forcing every possible password cheap for an attacker who obtains the hash database. Real password storage requires a purpose-built, salted, deliberately slow algorithm such as bcrypt, scrypt, or Argon2, not a general-purpose hash function used directly. If you found this tool while building password storage for your own project, this is the one thing to change before shipping it.