Hash Generator

Frequently Asked Questions

Why is MD5 not included?

MD5 is cryptographically broken - practical collision attacks exist. The Web Crypto API does not support it, and it should not be used for any security purpose.

Is this hash suitable for storing passwords?

No. SHA-256 is a fast hash function. A modern GPU can compute billions per second, making brute-force attacks trivially fast. Use bcrypt, scrypt, or Argon2id for passwords.

Does my text leave the browser?

No. This tool uses the Web Crypto API which runs entirely in your browser. Your input and the resulting hash are never transmitted to any server.

Why do different tools produce different hashes for the same text?

Text encoding differences are the most common cause. 'hello' in UTF-8 and in UTF-16 produce different byte sequences and therefore different hashes. This tool always uses UTF-8.

Provided by AllCalculators.io
Free online calculators for everyday. No registration required.

Estimates for informational purposes only.

Important Disclaimer: Estimates for informational purposes only.

This calculator provides estimates for informational purposes only. Results are based on assumptions and may not reflect actual outcomes. Consult qualified professionals in relevant fields before making important decisions based on these results.

JavaScript is required to use the interactive calculator above. The questions and answers below remain readable without JavaScript.

How It Works

A cryptographic hash function takes an arbitrary-length input and produces a fixed-length output called a digest. The same input always produces the same digest, but a single-character change in the input produces a completely different output (the avalanche effect). Critically, hash functions are one-way: you cannot reverse a digest back to the original input.

This generator encodes your text to UTF-8 bytes and passes them to the browser's built-in Web Crypto API (crypto.subtle.digest), then displays the raw bytes as a lowercase hexadecimal string. SHA-1 produces a 40-character digest, SHA-256 produces 64 characters, SHA-384 produces 96, and SHA-512 produces 128. All computation happens locally - your text is never sent to a server.

Use Cases

Cryptographic hashes serve many purposes in development and operations:

Verifying file integrity by comparing a downloaded file's hash against a published checksum

Generating Content-Security-Policy (CSP) script hashes to allowlist inline scripts without using unsafe-inline

Computing a deterministic, fixed-length identifier from a URL or string (etag generation, deduplication keys)

Producing HMAC inputs for API request signing (the message is hashed with a secret key)

Checking whether two strings are identical without revealing their content (though a constant-time comparison is also needed to prevent timing attacks)

Tips

Use SHA-256 as the default for new work - it is the current standard for most integrity and identification use cases.

SHA-1 is included for legacy compatibility only; it has known practical collision attacks and should not be used for security-sensitive purposes like code signing or certificates.

Never use a plain hash to store passwords - use a purposely slow, salted password hash like bcrypt, scrypt, or Argon2id instead, which are designed to resist brute-force attacks.

When comparing hashes in code, use a constant-time comparison function to prevent timing side-channel attacks; simple string equality leaks information about how many characters match.

The digest changes completely when the input encoding changes - ensure both sides of a comparison encode text identically (always UTF-8) before hashing.

FAQ

Why is MD5 not included?

MD5 is intentionally omitted. The Web Crypto API does not support it, and more importantly, MD5 is cryptographically broken - practical collision attacks exist where two different inputs produce the same MD5 hash. It should not be used for any security purpose.

Is this hash suitable for storing passwords?

No. SHA-256 and its variants are fast hash functions designed for speed. A modern GPU can compute billions of SHA-256 hashes per second, making brute-force dictionary attacks trivially fast. Use bcrypt, scrypt, or Argon2id for passwords - they are intentionally slow and memory-hard.

Does my text leave the browser?

No. This tool uses the Web Crypto API which runs entirely in your browser process. Your input text and the resulting hash are never transmitted to any server.

Why do different tools produce different hashes for the same text?

Text encoding differences are the most common cause. 'hello' encoded as UTF-8 and 'hello' encoded as UTF-16 produce different byte sequences and therefore different hashes. This tool always uses UTF-8 encoding.

Hash Generator

Frequently Asked Questions

Related Developer Tools Calculators