해시 생성기(SHA-256, SHA-512)

What a cryptographic hash is

A hash function takes any input — a word, a paragraph, or a multi-gigabyte file — and produces a fixed-length string called a digest. Three properties make it useful: the same input always yields the same digest; changing even one bit of the input changes the digest completely (the "avalanche effect"); and you can't reverse a digest back into the original. This tool computes digests with the SHA-1 and SHA-2 family algorithms directly in your browser, for either typed text or a file you drop in.

How the digest is computed here

The tool uses the browser's built-in SubtleCrypto API (crypto.subtle.digest) — the same vetted cryptographic implementation your browser uses for HTTPS, not a hand-rolled JavaScript version. For text, your input is first encoded to bytes with UTF-8 (via TextEncoder); for a file, the raw bytes are read directly. Those bytes are fed to the chosen algorithm, and the resulting binary digest is rendered as lowercase hexadecimal — each byte becoming two hex characters. That's why digest lengths are always the same regardless of input size.

The four algorithms and their output sizes

The tool reports the hex length and equivalent bit count beneath the output, so you can confirm at a glance that, say, a SHA-256 digest is exactly 64 characters.

A worked example

Hash the text hello with SHA-256 and you'll always get:

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Now change a single letter to Hello (capital H) and the digest is entirely different — there's no resemblance to the first, even though only one bit-group changed. That total scrambling is exactly what makes hashes reliable for detecting tampering: any modification, however small, is obvious.

Why SHA-1 is on the list but flagged

SHA-1's collision resistance is broken — researchers have produced two different inputs with the same SHA-1 digest, so it must not be used for digital signatures, certificates, or anything where an attacker might craft a malicious collision. It's still included because plenty of older systems and non-security checksums (verifying a download didn't corrupt in transit, deduplicating files) rely on it, and you sometimes need to reproduce a SHA-1 value to match an existing record. For anything security-relevant, choose SHA-256 or stronger.

Practical use cases

• Verifying downloads. Many projects publish a SHA-256 checksum next to a release. Switch to File mode, drop the downloaded file in, and compare the digest character-for-character against the published value — a match means the file arrived intact and unaltered.
• Detecting changes. Store a file's hash now; recompute later. A different digest proves the file changed, even if its size and date look identical.
• Generating stable identifiers. Hashing content gives a deterministic, fixed-length key for caching or deduplication.
• Cross-checking another tool. Confirm that a server-side or command-line hash (shasum -a 256) matches what your application expects.

Common mistakes

• Comparing different inputs. Text mode hashes the UTF-8 bytes of what you type, including any trailing newline or whitespace; a command-line tool hashing a file with a final newline will differ. Match the exact bytes.
• Using a hash where you need a password mechanism. A plain SHA digest is not a password-storage scheme — for that you need a slow, salted function like bcrypt, scrypt, or Argon2. SHA is built to be fast, which is the wrong property for password hashing.
• Trusting a digest without a trusted source for the expected value. A checksum only helps if the publisher's value itself is authentic (ideally served over HTTPS or signed).
• Confusing encoding. The output here is hexadecimal; some tools display Base64. The same digest in two encodings looks different but represents identical bytes.

Your data never leaves your device

All hashing runs locally through the browser's SubtleCrypto engine — your text and files are processed in memory and never uploaded, logged, or stored. Because the file bytes are read on your machine, you can hash large or sensitive files safely, and the tool keeps working with your network disconnected.