Hash Generator
Generate a SHA digest of any text, computed in your browser.
Runs entirely in your browser — nothing you paste is sent to our servers.
MD5 is deliberately not offered. It has had practical collisions since 2004, and the Web Crypto API declines to implement it for that reason. Nor should any of these be used for passwords — that needs bcrypt, scrypt or Argon2, which are slow by design.
What this tool does
The SHA-2 family
SHA-256, SHA-384 and SHA-512, plus SHA-1 for verifying legacy values you did not choose.
Web Crypto, not a JS reimplementation
Uses the browser native crypto.subtle, so the digest is the platform implementation rather than hand-rolled code.
Matches your shell
Hashes exactly the characters you type, with no trailing newline — the usual reason a value differs from sha256sum.
Live as you type
The digest updates on every keystroke, with no submit step.
Frequently asked questions
Where is the MD5 option?
Deliberately absent. MD5 is cryptographically broken - practical collisions have existed since 2004 - and the browser Web Crypto API does not implement it for that reason. We would rather not hand out a hash we would tell you to stop using.
Which hash should I use?
SHA-256 for almost everything. SHA-384 and SHA-512 give a longer digest without meaningfully more security for typical use. SHA-1 is included only because you may need to verify an existing legacy value; do not choose it for anything new.
Can I use this to hash passwords?
No. Password storage needs a slow, salted algorithm designed for the job - bcrypt, scrypt or Argon2. A plain SHA hash is far too fast, which is exactly what makes it easy to brute-force.
Is my input sent to a server?
No. Hashing uses crypto.subtle in your browser. Nothing is transmitted, which means it is safe to hash a value you would not want to upload.
Why is the hash different from my command line?
Almost always a trailing newline. Piping echo "x" into sha256sum hashes the text plus a newline; this tool hashes exactly the characters in the box. Use echo -n to compare.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.