Can a hash be reversed?

No. Hashing is one-way. Common inputs can be found by guessing against precomputed tables, which is why salting matters.

Should I hash passwords with SHA-256?

No. It is far too fast. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted.

Not for anything new — a practical collision was demonstrated in 2017. It is here for compatibility with older systems.

Which algorithm should I use?

SHA-256 unless something specifies otherwise. SHA-512 is often faster on 64-bit machines.

Is my text sent anywhere?

No. Hashing uses the Web Crypto API in your browser.

Hash generator — Free, no signup

Hash generator

Generate SHA-256, SHA-384, SHA-512 or SHA-1 hashes of text.

Text to hash

Algorithm

Runs in your browser — nothing is sent anywhere.

This tool needs JavaScript, because the work happens on your own device rather than on a server. Everything below — the guide and the answers — works without it.

What a hash is

A hash function turns any input into a fixed-length fingerprint. The same input always produces the same output, and changing a single character changes the result completely. Critically, it is one-way: you cannot recover the input from the hash.

Hashes are used to verify that a file arrived intact, to compare values without storing them, and as building blocks in signatures and tokens.

Choosing an algorithm

SHA-256 is the sensible default and what almost everything uses today. SHA-384 and SHA-512 produce longer digests and are, counter-intuitively, often faster on 64-bit hardware.

SHA-1 is included because a great deal of existing software still emits it — Git object IDs, older certificates, legacy integrity checks. It is cryptographically broken: a practical collision was demonstrated in 2017. Use it to verify against an existing system, never to secure anything new.

What this is not for

Do not hash passwords with these. A plain SHA hash is far too fast, which is precisely what makes it useless for passwords — an attacker with a stolen database can try billions of guesses per second. Password storage needs a deliberately slow, salted function such as bcrypt, scrypt or Argon2. This is one of the most consequential misunderstandings in web development.

It runs in your browser

Hashing uses the Web Crypto API on your device. Nothing is transmitted — which is the only responsible arrangement for a tool people will inevitably paste sensitive strings into.

Verifying a download

Publishers list a SHA-256 for their files. Hash the file you received and compare: identical means intact, different means corrupted or tampered with.