Hash Generator (SHA)
Produce a cryptographic hash of text or a local file using the Web Crypto API, and check it against an expected checksum. Useful for fingerprints, download verification and data-integrity checks.
How to use hash generator (sha)
- Enter text or upload a file
Type/paste content, or upload a local file to fingerprint a download or document.
- Choose an algorithm
Pick SHA-256 for general use, or SHA-512 for a longer digest.
- Generate and verify
Click Generate, then optionally paste an expected checksum to see if it matches — handy for checking a download's integrity.
Features
Hash typed text, or a local file up to your browser's memory limits — the file is read locally, never uploaded.
Paste an expected hash to get an instant match/mismatch check, ignoring case, whitespace and a leading 'sha256:' label.
Hashing uses the browser's native, audited crypto implementation.
SHA-1, SHA-256, SHA-384 and SHA-512 in one place.
Supported formats and limitations
Text and structured input supported by this tool.
Use cases include personal workflows, content preparation, and quick checks. Review output before relying on it for legal, financial, accessibility, or production decisions.
Frequently asked questions
Can I reverse a hash back to text?
No. Cryptographic hashes are one-way by design — you can only compare hashes, not undo them.
Why is SHA-1 marked as older?
SHA-1 is considered weak for security use. It's fine for non-security checksums but prefer SHA-256 or better for anything sensitive.
Is MD5 available?
No. MD5 is broken for security purposes, so this tool focuses on the SHA family provided by Web Crypto.
How do I verify a downloaded file's checksum?
Upload the downloaded file, pick the algorithm the publisher used (usually SHA-256), generate the hash, then paste the checksum they published into 'Compare to expected hash' — a match confirms the file wasn't corrupted or tampered with in transit.
Is my file uploaded anywhere to be hashed?
No. The file is read and hashed entirely in your browser using the Web Crypto API; it's never sent to a server.