Can a hash be reversed to get the original text?

Not mathematically. But short or common inputs, such as simple passwords, can be found by guessing and comparing hashes, which is why a plain SHA hash does not protect weak secrets.

Is the output uppercase or lowercase?

Lowercase hexadecimal. Hex comparisons are usually case insensitive, but if a system expects uppercase, convert the string before comparing.

Does the tool trim spaces or newlines?

No. Every character in the field is hashed, including leading and trailing spaces and line breaks.

Why is SHA-1 still offered?

Some older systems and file formats still publish SHA-1 values, and you sometimes need to reproduce one. For anything new, use SHA-256.

Can I hash a file here?

No, this page works on text. Use the file checksum calculator to hash files with MD5, SHA-1, SHA-256 or SHA-512.

Is my input sent to a server?

No. The hash is computed locally via WebAssembly. Nothing is uploaded, logged or stored.

SHA-256 Hash Generator for Text

This hash generator computes the SHA-256, SHA-1 or SHA-512 digest of any text you type or paste. A hash is a fixed length fingerprint: the same input always gives the same output, and changing a single character produces a completely different value. The digest is calculated in your browser by Rust code compiled to WebAssembly, so the text you hash, which is often a secret, a token or a piece of configuration, is never sent to a server.

How to generate a hash

Type or paste your text in the Input text field.
Choose the algorithm: SHA-256 (selected by default), SHA-1 or SHA-512.
Click Generate, or press Ctrl+Enter (Cmd+Enter on macOS).
Copy the result with the copy button in the top right corner of the output.

The output is lowercase hexadecimal, the format used by sha256sum, shasum and most APIs, so you can compare it directly with a reference value.

SHA-256, SHA-1 or SHA-512: which one to choose

Algorithm	Digest size	Hex length	Use it for
`SHA-256`	256 bits	64 characters	The default for integrity checks, content addressing, cache keys and API signatures
`SHA-1`	160 bits	40 characters	Compatibility with legacy systems only, for example matching an old checksum
`SHA-512`	512 bits	128 characters	When a specification asks for it, or when you want a larger security margin

SHA-1 is no longer considered collision resistant: practical attacks have produced two different inputs with the same SHA-1 hash. Do not use it for anything where an attacker could benefit from a forged match. SHA-256 and SHA-512 both belong to the SHA-2 family and have no known practical attacks.

Common uses

Comparing values without revealing them: two teams can confirm they hold the same API key or configuration string by comparing hashes instead of the secrets themselves.
Checking a test vector: verify that your own code produces the expected digest for a known input.
Building cache keys and identifiers: derive a stable ID from a URL, a query or a document body.
Debugging signature schemes: inspect the intermediate hash of a canonical request string while implementing an API client.

Why your hash does not match the command line

The tool hashes the exact UTF-8 bytes of the text field, nothing more. Differences almost always come from invisible characters:

Trailing newline: echo "hello" | sha256sum hashes hello followed by a newline. Use printf '%s' "hello" | sha256sum or echo -n to match what you typed here.
Line endings: text copied from a Windows file may contain \r\n where you expect \n.
Spaces and encoding: a trailing space, a non breaking space or a different Unicode normalization of an accented letter all change the bytes, and therefore the hash.

For reference, the SHA-256 of the empty string is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. The tool asks for at least one character, so you will not see this value here, but you will meet it in logs whenever an empty body was hashed by mistake.

What this tool does not do

No files: it hashes text. To hash a downloaded file, use the file checksum calculator, which also offers MD5 and batch mode.
No MD5: MD5 is only available in the file checksum tool.
No HMAC, salt or key: it computes a plain digest. HMAC signatures need a dedicated implementation.
Not for storing passwords: plain SHA hashes are fast, which makes them easy to brute force. Password storage needs a slow, salted algorithm such as Argon2, scrypt or bcrypt.

Privacy: the text you hash stays in your browser

People hash sensitive strings precisely because they are sensitive: API keys, passwords to compare, personal identifiers being pseudonymized, signing payloads. Sending them to an online hasher means a third party receives the clear text. Here the computation runs in a WebAssembly module inside your tab and no request carries your input anywhere. You can verify this in the Network tab of your browser's developer tools.

Frequently asked questions

Can a hash be reversed to get the original text?: Not mathematically. But short or common inputs, such as simple passwords, can be found by guessing and comparing hashes, which is why a plain SHA hash does not protect weak secrets.
Is the output uppercase or lowercase?: Lowercase hexadecimal. Hex comparisons are usually case insensitive, but if a system expects uppercase, convert the string before comparing.
Does the tool trim spaces or newlines?: No. Every character in the field is hashed, including leading and trailing spaces and line breaks.
Why is SHA-1 still offered?: Some older systems and file formats still publish SHA-1 values, and you sometimes need to reproduce one. For anything new, use SHA-256.
Can I hash a file here?: No, this page works on text. Use the file checksum calculator to hash files with MD5, SHA-1, SHA-256 or SHA-512.
Is my input sent to a server?: No. The hash is computed locally via WebAssembly. Nothing is uploaded, logged or stored.

Related tools: encode the raw bytes of a string with the Base64 encoder and decoder, or generate unique identifiers instead of derived ones with the UUID generator.