Get the SHA-256 of any file or text in seconds

SHA-1, SHA-256, SHA-384 and SHA-512 — every algorithm exposed by the browser's Web Crypto API. The digest is shown as a lowercase hexadecimal string, which is the format expected by checksum files, package manifests and HMAC tooling.

They differ in output length and design generation. SHA-256 is the modern default for integrity checks and most blockchain use. SHA-384 and SHA-512 produce longer digests that resist length-extension attacks. SHA-1 is shown for legacy compatibility but is no longer considered safe against collision attacks.

No — both are broken against deliberate collision attacks, so never use them for passwords, signatures or any security-sensitive work. They are included here purely for legacy compatibility: verifying old download checksums, ETags and existing manifests. For anything new, use SHA-256 or longer; for non-security uses like cache keys, SHA-256 truncated to the size you need works well.

Both. Paste a string or drop a file into the input box — the tool reads the file as a binary stream and feeds it directly to the hashing API, so the digest matches the one produced by sha256sum, openssl dgst or PowerShell's Get-FileHash.

No. Cryptographic hashes are one-way functions: given a digest, there is no efficient way to recover the input. That is the entire point — integrity checks, password storage and signatures all rely on this property.

No. The Web Crypto API runs the hash inside your browser, so the input never crosses the network. That makes the tool safe for secrets, private keys and any file you would not want to upload.

Yes. Switch the Source toggle to Text to hash a pasted string, or to File to drop in any file. Either way the tool computes SHA-1, SHA-256, SHA-384 and SHA-512 at once and lets you copy any of them, so a file digest matches what sha256sum or PowerShell's Get-FileHash would produce.

Each algorithm row (MD5, SHA-1, SHA-256, SHA-384, SHA-512) has its own Copy button next to the hex digest. The large primary button at the bottom is a shortcut for SHA-256 specifically since it's the most commonly requested value, but every other digest can be copied individually the same way.

Yes — MD5 is shown alongside SHA-1, SHA-256, SHA-384 and SHA-512 even though the browser's built-in Web Crypto API doesn't implement MD5. The tool includes its own pure-JavaScript MD5 implementation specifically so you can match checksums against old downloads, ETags and manifests that still publish MD5 — it's included for legacy compatibility, never for anything security-sensitive.

Click Clear at any time to wipe the pasted text or dropped file — the previous digests disappear immediately so you're never comparing a stale hash by accident. You can also just switch the Source toggle between Text and File; each source keeps its own input independently.

Switch the Source toggle to File, drop the download (installer, ISO, archive) into the tool, and compare the SHA-256 row against the checksum published on the publisher's site — use the one-click Copy SHA-256 button to paste it straight into a comparison instead of retyping the long hex string. Because hashing runs locally via Web Crypto, the file itself never leaves your device during the check.

No — this tool computes fixed digests: MD5, SHA-1, SHA-256, SHA-384 and SHA-512. Bcrypt, scrypt and Argon2 are deliberately slow, salted algorithms designed for storing login passwords, and they belong in your backend code, not in a converter. You can still hash any text here with SHA-256 for checksums or cache keys, but never store user passwords as plain unsalted digests.

A hash value is a fixed-length fingerprint computed from your input: SHA-256 always yields 64 hex characters whether you hash one word or a 2 GB file. The same input always produces the same value, while a one-byte change produces a completely different one — which is exactly what makes a hash value generator useful for integrity checks and duplicate detection.