Processed locally — your file never leaves your device
Hash Generator
Compute SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text entirely in your browser.
Hashing only goes one way — there is no matching decoder, here or anywhere, because a hash discards the original text rather than hiding it. If you need something reversible, use an encoder instead: Base64, URL, HTML and Unicode all come as encode/decode pairs.
These are fast, general-purpose cryptographic hash functions — never use them to store passwords. For password storage, use a dedicated, slow, salted algorithm (bcrypt, scrypt, or Argon2) on a server, not a hash computed in a browser.
How it works
- Paste text.
- Click Compute hashes.
- SHA-1, SHA-256, SHA-384 and SHA-512 are all computed at once — copy any of them individually.
Frequently asked questions
- Is my text sent anywhere?
- No. Hashing happens entirely on your device using the browser's built-in Web Crypto API.
- Is there a hash decoder to turn a hash back into text?
- No — and no tool can have one. A hash is one-way by design: it maps input of any length onto a fixed-length fingerprint, throwing information away in the process, so the original text simply isn't in there to recover. Sites advertising a "hash decoder" are looking your hash up in a precomputed table of common inputs, which only ever works for short, already-known values. If you need something you can reverse, you want encoding, not hashing — see Base64 Encode / Decode, URL Encode / Decode, HTML Encode / Decode, or Unicode Escape / Unescape in the Developer Toolkit's Encoding section, which each come as a matched pair.
- Can I use this to hash and store passwords?
- No — never store passwords with a fast general-purpose hash like SHA-256. Use a dedicated, slow, salted password hashing algorithm (bcrypt, scrypt, or Argon2) on your server instead. These hashes are meant for checksums, integrity checks and general-purpose fingerprinting, not password storage.
- Why isn't MD5 offered?
- Browsers' native Web Crypto API doesn't implement MD5. It's also broken for any security-sensitive use, so it isn't worth adding a separate implementation for.
- Is SHA-1 safe to use?
- It's no longer considered collision-resistant for security purposes, but it's still offered here for compatibility with legacy checksums. Prefer SHA-256 or better for anything new.