AllUtil

Hash Generator

Generate cryptographic hashes from any text using SHA-1, SHA-256, SHA-384, or SHA-512.

  • Free
  • No account
  • Runs in your browser
  • Nothing uploaded
Hash GeneratorNothing uploaded
0 characters

Enter text and click Hash — the hash is computed in your browser using crypto.subtle.digest() and never sent anywhere.

Runs entirely in your browser — your input is never uploaded, logged, or stored.Privacy policy

What is Hash Generator?

A cryptographic hash function takes an input of any size and produces a fixed-length string that acts as a digital fingerprint. Change one character in the input and the entire hash changes — a property called the avalanche effect. This makes hashes useful for verifying data integrity, storing passwords securely, and creating digital signatures.

This tool uses the Web Crypto API, the same interface browsers use for TLS certificates and payment processing. The hash is computed entirely in your browser — no text is sent to any server. You can verify this by checking your browser's network tab: there are no outbound requests when you click Hash.

Common algorithms and their outputs: • SHA-1: 40 hex characters (160 bits) — legacy, still used in Git commit IDs and file checksums. • SHA-256: 64 hex characters (256 bits) — the standard for most security applications. • SHA-384: 96 hex characters (384 bits) — used in TLS and high-security contexts. • SHA-512: 128 hex characters (512 bits) — maximum output, used in blockchain and certificate chains.

All four algorithms belong to the SHA-2 family (except SHA-1, which is SHA-1). None of them are broken for their intended purposes, though SHA-1 has known theoretical weaknesses that make it unsuitable for new security applications.

Each algorithm follows the Merkle-Damgård construction:

1. Pad the input to a multiple of the block size (512 bits for SHA-256, 1024 for SHA-512). 2. Process the input in blocks through a compression function. 3. Output the final hash value.

The Web Crypto API's subtle.digest() method handles this internally. For HMAC (Hash-based Message Authentication Code), the hash is computed as HMAC(key, message) = H((key ⊕ opad) || H((key ⊕ ipad) || message)), which adds a secret key to the hash — useful for verifying that data was signed by someone who knows the key.

Collision resistance means it should be computationally infeasible to find two different inputs that produce the same hash. SHA-1 collisions have been demonstrated (SHAttered, 2017), but no practical collision attacks exist for SHA-256.

Worked examples

  • Hash "hello" with SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
  • Hash "hello" with SHA-512: 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043
  • Hash "Hello, World!" with SHA-256: dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f
  • Hash "Hello, World!" with SHA-1: 0a0a9f2a6772942557ab5355d76af442f8f65e01
  • HMAC-SHA256 of "hello" with key "secret": 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b

How to use Hash Generator

  1. Paste your text in the input box.
  2. Select an algorithm (SHA-256 is the most common choice).
  3. Optionally enter a key to compute HMAC instead of a plain hash.
  4. Copy the result. Nothing is stored or sent anywhere.

Common errors

  • Output is uppercase hex — some tools output lowercase. Both are equivalent; the hash value is the same.
  • HMAC output differs from plain hash — HMAC combines the key with the message using a specific construction. Changing the key changes the entire output, even if the message is the same.
  • Different tools give different SHA-1 hashes for the same input — some tools hash the UTF-8 bytes, others hash the ASCII characters. This tool always hashes the UTF-8 encoding.
  • Hash looks truncated — SHA-384 is a truncated version of SHA-512, and its output is intentionally shorter. This is normal and specified by the standard.

FAQ

Is this safe for hashing passwords?

For password storage, use a dedicated password hashing function like bcrypt, scrypt, or Argon2 — not SHA-256. SHA-256 is fast by design, which means an attacker can try billions of guesses per second. Password hash functions are deliberately slow and include a salt to prevent rainbow table attacks.

What's the difference between a hash and HMAC?

A hash is a one-way transformation of the input. HMAC adds a secret key, so only someone with the key can produce a valid HMAC. Use HMAC to verify that data was signed by someone who knows the key — for example, verifying a webhook payload.

Why are there multiple hash algorithms?

Different algorithms offer different trade-offs: SHA-1 is fast but has known weaknesses; SHA-256 is the standard for most security applications; SHA-512 is slower but provides more output bits. The choice depends on your threat model and performance requirements.

Can I reverse a hash to get the original text?

No. Cryptographic hash functions are one-way — you cannot recover the input from the output. You can verify a hash by hashing the original text again and comparing, but you cannot work backwards from the hash.

What is the avalanche effect?

Changing even one character in the input completely changes the output hash. For example, hashing 'hello' and 'Hello' produces completely different SHA-256 values. This property makes hashes useful for detecting any modification to data.

Related tools

G

Prefer AllUtil on Google

One click adds AllUtil to your Google preferences. You'll see our tools highlighted with a Preferred badge in Search and AI answers.

2× more likely to clickWorks in AI Overviews
Add on Google