tag Hash Generator (SHA-256 / SHA-512) star

How It Works

A cryptographic hash function takes an input of any size — a word, a paragraph, a multi-gigabyte file — and produces a fixed-length output called a digest: 160 bits for SHA-1, 256 for SHA-256, 384 for SHA-384, 512 for SHA-512. This tool computes all four locally using the browser's built-in WebCrypto engine, the same audited implementation your HTTPS connections already rely on, so even large files hash quickly and never leave your device.

Three properties make these functions useful. First, they are one-way: given a digest, there is no practical way to recover the original input — the only option is to re-hash a guess and compare. Second, they are deterministic: the same input always produces exactly the same digest, which is what makes a checksum meaningful in the first place. Third, they exhibit the avalanche effect — changing a single bit of the input, say one character in a multi-gigabyte file, flips roughly half the bits of the output. A digest that differs by even one hex character means the inputs are not identical, full stop.

Typical example: a software vendor publishes sha256sum: 9f86d0... alongside a download. After downloading, hash the file here and compare the two strings character by character — if they match, the file arrived intact; if they do not, it was corrupted or tampered with in transit. The same technique works for comparing two files for byte-identical content, or for generating a stable cache-busting key from a file's contents.

What You Should Know

MD5 is deliberately not offered. It is cryptographically broken: researchers have demonstrated practical collision attacks, meaning two different inputs can be crafted to produce the identical MD5 digest, which defeats its purpose for integrity or security checks. Browsers' WebCrypto API excludes it entirely for this reason. If a vendor only publishes an MD5 checksum, treat it as a last resort and ask for SHA-256 — virtually every modern distribution provides one.

SHA-1 is fine for detecting accidental corruption (a bad download, a disk error) but is deprecated for security purposes such as certificates and digital signatures, since collision attacks against it have also been demonstrated; prefer SHA-256 or higher whenever the result needs to resist a deliberate attacker.

Finally, hashing alone is not how passwords should be stored: a bare SHA-256 of a password is fast to compute, which means an attacker with a stolen database can try billions of guesses per second. Proper password storage adds a unique random salt per account and uses a slow, purpose-built function (bcrypt, scrypt, or Argon2) — this tool is for checksums and integrity verification, not authentication.