Skip to main content

Security Hash Generator

Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes from text or files using the Web Crypto API.

Reviewed by · Last reviewed

Hashing for Password Verification and File Integrity

  1. Choose an input source. Paste text into the input box for short data, or drop a file onto the file-upload zone to hash an entire artifact (installer, ZIP, certificate).
  2. Click "Generate Hashes". The tool reads the file as an ArrayBuffer (or encodes the text to UTF-8 bytes) and runs all four SHA-2 digests in parallel through crypto.subtle.digest().
  3. Read the four output rows. Each shows one algorithm name plus the hex digest; the widths (40, 64, 96, 128 hex characters) correspond to 160, 256, 384, and 512 bits of output.
  4. Toggle "Uppercase" to match the case convention of whichever external checksum you are comparing against. Most Linux distros publish lowercase; Microsoft and some older tools use uppercase.
  5. Copy a digest by clicking the copy icon next to the line you want. Paste it into a diff tool or a terminal and compare byte-for-byte; eyeballing is unreliable past 16 characters.

Why This Page Is Not Just Another Hash Tool

This page is framed around security use: password verification, file-integrity attestation for signed downloads, and the primitives password-hashing schemes are built on. The implementation uses Web Crypto SubtleCrypto, constant-time for SHA-2 and free of side-channel leaks that plague hand-rolled JavaScript. File hashing reads the File via file.arrayBuffer() and passes the buffer to crypto.subtle.digest; a 500MB download takes about a second on a modern laptop. No bytes leave the tab - verified by absence of fetch calls. The four SHA-2 variants are in FIPS 180-4 and approved by NIST for digital signatures, HMAC, and key derivation. SHA-3 (FIPS 202) is not exposed because Web Crypto predates its standardization.

Threat-Model-Specific Scenarios

  • Verifying that an Ubuntu ISO you downloaded matches the SHA-256 published on releases.ubuntu.com, defending against a poisoned mirror or a MITM on an HTTP mirror.
  • Confirming a signed binary (macOS .dmg, Windows .msi, Linux .deb) matches the vendor\'s published SHA-256 before running it on a production server.
  • Computing the digest input for a digital signature scheme - ECDSA and RSA-PSS both sign a hash, not raw data, and expect a SHA-256 or SHA-384 digest.
  • Generating a stable file fingerprint for an audit log entry so you can prove later that a specific file existed at a specific time without storing the file itself.
  • Building a Merkle tree for content-addressable storage, where each leaf is a SHA-256 of a chunk and the tree root commits to the whole file.
  • Hashing a CSR or certificate body for a certificate transparency log entry, where SHA-256 is mandated by RFC 6962.

Why MD5 and SHA-1 Cannot Be Password Hashes

Every algorithm in this tool is a fast cryptographic hash - fast being the explicit design goal. A modern GPU can compute 10+ billion SHA-256 operations per second; an ASIC cluster mining Bitcoin computes 300+ exahashes per second globally. Fast is exactly wrong for password hashing. The LinkedIn 2012 incident is the textbook example: 6.5 million passwords were stored as raw unsalted SHA-1. Within 72 hours of the breach publication, crackers using the RockYou wordlist (32 million real passwords from the 2009 RockYou leak) and hashcat rule expansions had recovered over 90 percent of the passwords. The fix is not to pick a longer SHA variant - it is to switch to a deliberately slow password-hashing function. NIST SP 800-63B section 5.1.1.2 mandates PBKDF2, bcrypt, balloon, or Argon2 with per-user salt. Use the companion PBKDF2 tool on this site for correct password hashing; use this tool only when the goal is fast integrity digest, not credential storage.

The SHA-2 Family and What FIPS 180-4 Actually Says

FIPS 180-4 (Secure Hash Standard, August 2015) specifies SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. The Merkle-Damgard construction they share processes the input in fixed-size blocks (512 bits for SHA-1/224/256, 1024 bits for SHA-384/512) through a compression function built from a Davies-Meyer-style block cipher. The constants come from the fractional parts of cube roots of the first 64 primes, chosen for nothing-up-my-sleeve rigor. Collision resistance is bounded by the birthday attack at 2^(n/2) operations for an n-bit output, so SHA-256 gives 128-bit collision security and SHA-512 gives 256-bit. FIPS 202 (SHA-3, Keccak) offers the same security with a completely different construction as insurance. NSA Suite B used SHA-384 for TOP SECRET protection; FIPS 202 added SHAKE-128 and SHAKE-256 extendable-output functions useful for deterministic randomness extraction. Pick SHA-256 by default, SHA-384 or SHA-512 when you need extra margin or are matching a specification.

When a Platform Native Tool Is Better

For gigabyte-scale downloads, the OS-native tool wins: shasum -a 256 ubuntu.iso on macOS, sha256sum on Linux, Get-FileHash -Algorithm SHA256 on PowerShell. Those stream from disk and handle files larger than browser memory limits. This tool wins for cross-platform convenience or when the user has no terminal. For application code, use the language library (hashlib, node:crypto, java.security.MessageDigest) rather than shelling out. For password hashing, this tool is the wrong primitive - reach for Argon2id (OWASP 2024 recommendation), bcrypt, or PBKDF2 via the companion tools.

Frequently Asked Questions

Can I use SHA-256 to hash a password before storing it?

No. Raw SHA-256 is fast by design, and a GPU can test 10 billion candidates per second against a stolen hash. The LinkedIn 2012 breach was unsalted SHA-1 and roughly 90 percent of the 6.5 million passwords were recovered from the RockYou wordlist within weeks. For password storage, use Argon2id (OWASP 2024 recommendation), bcrypt, or PBKDF2-HMAC-SHA-256 with 600,000+ iterations and a per-user salt. The PBKDF2 tool on this site is the correct choice; SHA-256 as a bare hash is the wrong primitive for credentials regardless of how many bits it outputs.

Are files I upload sent anywhere?

No. The file is read into memory via the standard File.arrayBuffer() method and passed directly to crypto.subtle.digest(), which is implemented in your browser engine's native crypto library (BoringSSL for Chromium, NSS for Firefox, CoreCrypto for Safari). There is no multipart upload, no fetch, and no service-worker intercept. You can drop a classified document into this page while air-gapped and it will still compute the hash. The file is freed as soon as the digest resolves.

How big a file can the browser actually hash?

Limited by browser memory. Chrome allows roughly 2 GB as a typed array in a single tab; Firefox and Safari vary. Above that, the File.arrayBuffer() call can throw a RangeError or the tab can crash. For larger files, use shasum -a 256 or PowerShell Get-FileHash, which stream in 64KB chunks from disk without loading the whole file. A streaming Web Crypto API has been proposed but is not standard in 2026.

How do I know which SHA variant to match when verifying a download?

Look at the checksum file that came with the download. SHA256SUMS and *.sha256 files list SHA-256 digests; *.sha512 files list SHA-512. The digest length is itself a clue: 64 hex characters is SHA-256, 128 is SHA-512, 40 is SHA-1. Distributions publish SHA-256 almost universally now, sometimes alongside a GPG signature on the SHA256SUMS file itself - verifying the signature first is the complete chain of trust.

Is SHA-1 ever still acceptable?

Only for non-adversarial checksums where collision resistance does not matter. Git object IDs, rsync checksums, and some CDN cache keys still use SHA-1 because the threat is accidental corruption, not an attacker crafting two inputs with the same hash. Since SHAttered (2017) and Chosen-Prefix Collisions (2020, around 45,000 dollar compute cost), SHA-1 must not be used for signatures, certificate fingerprints, or any security boundary. TLS certificates stopped supporting SHA-1 in 2016.

What is the difference between SHA-2 and SHA-3?

SHA-2 (FIPS 180-4) uses the Merkle-Damgard construction with a Davies-Meyer-style compression function. SHA-3 (FIPS 202, 2015) uses the completely unrelated Keccak sponge construction. Both offer the same security level at the same output size. SHA-3 is not in this tool because Web Crypto exposes only SHA-2. Cryptographers keep both standards active as insurance - if a breakthrough ever damages SHA-2, SHA-3 is ready as a drop-in replacement. For new designs with no constraint, pick SHA-256 or SHA-384 for ecosystem compatibility.

What is a length-extension attack and does it matter here?

Merkle-Damgard hashes (SHA-1, SHA-256, SHA-512) suffer length-extension: given H(key || msg) and the length of key||msg, an attacker can compute H(key || msg || padding || attacker_data) without knowing the key. This breaks naive MAC schemes like "hash secret then message". The fix is HMAC (RFC 2104), which double-hashes with inner and outer padding. SHA-3 and SHA-384 are not vulnerable. For message authentication, never use bare SHA-256 with a secret prefix - always use HMAC.

Why does text with a trailing newline produce a different hash?

Because hash functions are deterministic to the byte. "hello" (5 bytes) and "hello\n" (6 bytes) are different inputs. When comparing hashes across platforms, check line endings: Windows CRLF (0x0D 0x0A) and Unix LF (0x0A) differ. If a checksum file was produced on Linux and you computed one on Windows Notepad that auto-added CRLF, they will differ.

More Security & Privacy

AES-256 Encrypt / Decrypt Online - Free, In-Browser

Encrypt and decrypt text with AES-128, AES-192, or AES-256 in GCM, CBC, or CTR mode. PBKDF2 key derivation, entirely in your browser.

Open tool

Basic Auth Header Generator

Create HTTP Basic Authentication headers from a username and password or API token.

Open tool

CSP Header Generator

Build Content-Security-Policy headers with a visual form, presets and per-directive configuration.

Open tool

Password Entropy Calculator

Estimate password entropy, character pool size and crack-time ranges for online and offline attacks.

Open tool

Password Generator

Generate cryptographically secure random passwords with configurable length, character types and entropy display.

Open tool

Password Strength Checker

Check password strength with entropy calculation, pattern detection and common password matching.

Open tool