String Hash Tools

What a hash function does

A hash function takes any input — a word, a paragraph, a whole file's text — and produces a fixed-length string that acts as a fingerprint of that input. Change a single character and the fingerprint changes completely. The same input always yields the same output, but you cannot run the process backward to recover the original from the hash. This tool computes seven different hashes of whatever you type, all at once, entirely in your browser, and updates them live as you edit. It's useful for verifying that two pieces of text are byte-for-byte identical, generating checksums, and learning how the major algorithms differ.

The seven algorithms, and what each is for

The four SHA variants are computed with the browser's built-in Web Crypto API, the same vetted implementation that secures HTTPS. MD5, CRC32, and FNV-1a are computed by small pure-JavaScript routines included in the tool, because browsers don't expose those natively.

A worked example

Type the single character a. Its MD5 is 0cc175b9c0f1b6a831c399e269772661 and its SHA-256 is ca978112ca1bbdcafac231b39a23dc4d…. Now change it to b: every hash transforms entirely — this is the avalanche effect, where a one-bit change flips roughly half the output bits. That property is exactly what makes hashes good fingerprints. Switch the output toggle from HEX to Base64 and the same digest is shown re-encoded: Base64 packs the same bytes into fewer characters using a 64-symbol alphabet, which is why it looks shorter even though it represents identical data.

Compare mode: proving two strings are identical

Enable Compare Mode and paste a second string. The tool hashes both and labels each algorithm Match or Different. This is the practical heart of hashing: instead of comparing two long texts character by character, you compare their short fingerprints. If even one algorithm reports Different, the inputs are not identical — perhaps a trailing space, a different line ending, or an invisible character. It's a fast way to confirm that a copied snippet, a downloaded value, or a re-typed token exactly matches the original.

Choosing the right algorithm

• Verifying a download or detecting accidental corruption: CRC32 is built for this and is extremely fast, but it only catches accidental changes, never deliberate tampering.
• Indexing strings in a hash map or cache key: FNV-1a is small, fast, and spreads values well; it is not meant to resist attackers.
• Anything touching security — integrity checks of untrusted data, digital signatures, content addressing: use SHA-256 or stronger.
• MD5 and SHA-1 appear here for compatibility with older systems and to compare against legacy values. Both have practical collision attacks, so never rely on them where an adversary could craft a colliding input.

HEX versus Base64 output

The toggle switches how each digest is displayed without changing the hash itself. HEX writes every byte as two hexadecimal characters, so a 256-bit SHA-256 becomes 64 characters drawn from 0–9 and a–f — the format you'll see in most command-line tools and checksum files. Base64 re-packs the same raw bytes three at a time into four characters from a 64-symbol alphabet, ending in = padding; it is more compact and is what many web APIs, HTTP headers, and JSON payloads expect. Pick HEX when you need to match a checksum from a terminal, and Base64 when you're pasting a digest into a system that asks for it. Each row also has a Copy button so you can grab a single value without selecting it by hand.

Common mistakes

The most important one to avoid: a hash is not encryption and not a safe way to store passwords. Plain MD5 or SHA-256 of a password is trivially reversed with precomputed tables; real password storage needs a slow, salted algorithm such as bcrypt or Argon2. A second pitfall is comparing hashes of text that differs only in whitespace or newline style — the digests will differ even though the content "looks" the same, so normalise line endings first if that matters. A third is assuming Base64 and HEX are different hashes; they are just two encodings of the identical underlying bytes. Everything here runs locally — your input is never transmitted, which you can confirm by disconnecting from the network and watching the hashes still update.