SHA-256 hash generator
A digest is a fixed-length signature: change one character and it changes entirely. It exists to compare, never to hide — you cannot get back from a digest to the original text.
Computed by the browser's Web Crypto API, the same implementation used for TLS. Nothing is sent.
How the check works
- 1
Text becomes bytes
UTF-8 encoding, so that two identical texts give the same digest everywhere.
- 2
Four digests are computed
SHA-1, SHA-256, SHA-384 and SHA-512, through crypto.subtle.digest.
- 3
The result is rendered in hex
64 characters for SHA-256, the form most tools expect.
SHA-256 is not made for passwords
A SHA digest takes nanoseconds, and that is precisely the problem: a graphics card tries billions per second. A password needs a slow, salted function — bcrypt, scrypt or Argon2.
SHA-256 remains the right tool for what it is for: checking a file has not changed, indexing content, signing a message.
SHA-1 is here for compatibility
It has been broken since 2017: two different documents with the same digest can be manufactured. It should no longer serve any security purpose, but legacy systems still use it and it sometimes has to be recomputed.
Frequently asked questions
Can the text be recovered from its hash?
No, the function is not invertible. But a short, predictable text — a dictionary word, a common password — is found by brute force or a precomputed table in seconds. Mathematical irreversibility does not protect a weak secret.
Can two texts share the same hash?
Theoretically yes: there are infinitely many texts and finitely many digests. In practice no SHA-256 collision has ever been produced. For SHA-1 it was done in 2017, which retired it from serious use.
Why does my hash differ from another tool's?
Almost always an invisible character: a trailing newline, a trailing space, or a different encoding. A digest covers exact bytes, not a text that is 'roughly' the same.
The same check over API
This tool runs in your browser. To run the same check from your code, in bulk or server-side, the API answers in JSON.
Read the documentation