SHA Hash Generator

A hash turns any input into a fixed-length fingerprint. The same input always produces the same digest, a one-character change produces a completely different one, and there is no way to work backwards from the digest to the input. Those three properties are what make hashes useful for verifying that something arrived intact.

All four algorithms are computed at once as you type, because in practice you are usually checking a digest against one somebody else produced, and knowing which algorithm they used is half the problem. Seeing all four side by side means you can just look for the one that matches.

This uses the Web Crypto API — the browser's own implementation — so a digest computed here is byte-identical to what your server, your CI and your package manager will compute for the same input. Text is hashed as UTF-8 bytes, which is what every server-side implementation does; hashing UTF-16 code units instead would give a different digest for the same visible text and quietly disagree with everything.

SHA-1 is included and labelled honestly. It has been broken for signature purposes since 2017, when a practical collision was demonstrated, and it should never be used where an attacker could benefit from forging a match. It remains perfectly serviceable as a checksum against accidental corruption, and plenty of existing systems still emit it, which is why it is here.

One thing a hash is not for: storing passwords. A plain hash is fast by design, and fast is exactly wrong for a password — an attacker with the digests can try billions of guesses a second. Passwords need a deliberately slow function such as bcrypt, scrypt or Argon2, which no general-purpose hash tool should pretend to replace.