Generate cryptographic hashes from text or files using SHA-256, SHA-512, SHA-384, and SHA-1 — directly in your browser. This guide explains what hashing is, when to use it, and which algorithm to choose.
A cryptographic hash function takes any input — a word, a file, an entire database — and produces a fixed-length fingerprint called a digest or hash. No matter how large the input, SHA-256 always produces exactly 64 hexadecimal characters (256 bits).
Three properties define a cryptographically useful hash: determinism (same input always gives same output), avalanche effect (changing one character changes roughly half the output bits), and one-way function (you cannot reverse a hash to find the original input without brute force).
These properties make hashing fundamental to file integrity verification, password storage, digital signatures, and blockchain technology.
SHA-1 produces a 160-bit (40 hex character) digest. It is cryptographically broken — researchers demonstrated collision attacks in 2017 (the SHAttered attack). Use SHA-1 only when legacy compatibility is strictly required, never for new security-sensitive applications.
SHA-256 is part of the SHA-2 family and remains the most widely deployed cryptographic hash in the world. It powers SSL/TLS certificates, Bitcoin mining, JWT tokens, and most file integrity verification systems. 64 hex characters, 256-bit security, no known practical attacks.
SHA-512 produces a 128-character (512-bit) digest and is marginally faster than SHA-256 on 64-bit hardware for large inputs. Use it when maximum hash size is required, such as for cryptographic key derivation or high-security storage applications.
SHA-384 is a truncated version of SHA-512 and is mandated by TLS 1.3 for certain cipher suites. It is rarely needed for general use but included for completeness in thorough hash tools.
When you download software, the publisher often provides a SHA-256 checksum alongside the download. This allows you to confirm the file arrived unmodified:
A single character difference — even in a file of gigabytes — means the files differ. This detects both corruption during download and malicious tampering.
HMAC (Hash-based Message Authentication Code) extends regular hashing with a secret key. Where a plain hash verifies that data is unchanged, an HMAC verifies that data is unchanged and was produced by someone who holds the secret key.
HMAC is used in API authentication (many REST APIs sign requests with HMAC-SHA256), JWT token verification (HS256 algorithm), and secure cookie signing. Use the SHA Hash Generator which includes a dedicated HMAC tab for generating and verifying HMAC signatures.