In short: Hashes verify downloads, fingerprint files, and anchor APIs; whatever the job, the hash must be computed locally or the trust chain leaks. This generator runs the Web Crypto API in your browser: SHA-1, SHA-256 and SHA-512 of your text, computed on your machine with nothing sent anywhere.
Updated August 28, 2026, after a fresh review, with updated visuals and links.
Which hash for which job
SHA-256 is the modern default: checksums for downloads, content fingerprints, blockchain ancestry. It produces a 64-hex-character digest; 'hello world' always starts with b94d27b9, which is a handy way to confirm the tool is working.
SHA-512 stretches to 128 characters and is actually faster than SHA-256 on 64-bit systems, while SHA-1 (40 characters) survives only for legacy compatibility and is considered broken for collision resistance.
Because the same input always gives the same digest, hashes verify integrity: download a file, hash it, compare with the one the site published. One flipped bit changes half the output characters.
Worth remembering
- Never store passwords as plain SHA-256; fast hashes are brute-forceable. Passwords need slow KDFs like bcrypt or Argon2 with a salt.
- For file hashing, paste the file's content only if it is text; for binaries use a terminal command like sha256sum instead.
Frequently asked
Can a hash be reversed to recover the text?
No: hashing is one-way by design. Attackers instead hash dictionaries of candidates until one matches, which is why short inputs (like weak passwords) are vulnerable even though the algorithm itself is not.
Why does 'hello world' always produce the same hash?
Determinism is the entire point: identical input, identical digest, always. That property is what lets you verify a file anywhere, anytime, without trusting the source twice.
Find every related tool in our Developer Tools: Every Free Utility index.
