Produce a cryptographic hash of any text using your browser's own crypto engine — SHA-256, SHA-1, SHA-384 or SHA-512, instantly and privately.
Add your file
Drop your file into the box above or click to browse. It's processed privately in your browser — nothing is uploaded.
Choose your options
Adjust the available settings to get exactly the result you need.
Download the result
Run the tool and download your file instantly — no sign-up, no watermark.
A cryptographic hash turns any amount of text into a short fixed-length string. Change a single character of the input and the output changes completely and unpredictably, which is what makes hashes useful for checking integrity: if the hash matches, the data matches.
This tool uses the Web Crypto API built into your browser rather than a hashing library downloaded from the internet. That means the implementation is the same audited code your browser uses for https itself, and nothing about your input crosses the network.
SHA-256 is the right default for almost everything — file checksums, content addressing, integrity checks and API signatures. SHA-1 remains available because older systems still emit it and you sometimes need to verify what they produced, but it should not be chosen for anything new.
A hash is a fixed-length fingerprint of some data. It is used to verify that a download or a message has not been altered, to compare two values without storing the originals, and as a building block in signatures and blockchains.
MD5 has been broken for collision resistance since 2004 — two different inputs can be made to produce the same hash — so browsers deliberately do not ship it. SHA-256 is the safe default and is what modern checksums use.
SHA-256 unless something specific requires otherwise. SHA-1 is only for verifying legacy systems that still use it; SHA-384 and SHA-512 produce longer digests and suit high-assurance use.
No. Hashing is one-way by design. Short or common inputs can be guessed by brute force from precomputed tables, which is exactly why passwords are salted before hashing.
The hashing runs entirely in your browser and nothing is transmitted, so typing a password here does not expose it. Storing passwords, though, needs a slow algorithm like bcrypt or Argon2 rather than a raw SHA hash.
The Web Crypto API is only available in a secure context, which is a browser rule rather than ours. On a live https site it works everywhere.
Generate QR codes for URLs, text, Wi-Fi and more.
Count words, characters, sentences and reading time as you type.
Convert text between UPPER, lower, Title, camelCase, snake_case and more.
Format, validate, minify and sort JSON — with clear error messages.
MD5 isn't offered: it's been broken for collision resistance since 2004 and browsers don't ship it. SHA-256 is the safe default.