Hash Generator

Cryptographic Hashes: What They Do, What They Don't

A cryptographic hash is a one-way function that maps any-length input to a fixed-length output (the digest). The defining properties: identical inputs always produce identical outputs; even the smallest change to the input completely scrambles the output; and given the digest, it is computationally infeasible to recover the input or find a different input that produces the same digest.

Hashes are not encryption. There is no key, no decryption — the function is deliberately one-way. A hash digest tells you "this is the fingerprint of some data" but tells you nothing about the data itself. Don't use hashes to "hide" data; use them to verify integrity, build signatures, or derive keys.

The Algorithms in This Tool

• SHA-256 (256-bit digest, 64 hex chars) — modern default. Fast, secure, supported everywhere. Used by Bitcoin, TLS certificates, GitHub commits (since 2025), and HMAC signing for most webhook providers.
• SHA-512 (512-bit digest, 128 hex chars) — same family, larger output. Marginally faster on 64-bit CPUs. Use when you specifically need 512 bits of output (e.g., to seed key-derivation functions); SHA-256 is otherwise interchangeable.
• SHA-384 — truncated SHA-512 to 384 bits. Used in some TLS cipher suites and certificate signing.
• SHA-1 ⚠ (160-bit, 40 hex chars) — deprecated for security. Practical collision attacks exist (SHAttered, 2017). Still used for Git commits (transitioning to SHA-256), older HMAC contexts, and non-security checksums.
• MD5 ⚠ (128-bit, 32 hex chars) — broken. Trivial collisions, fast brute force. Do not use for any security purpose. Acceptable for cache keys and accidental-corruption checks where collision resistance doesn't matter.

Common Use Cases

• File integrity — download a file and a published checksum; compute the hash locally; compare. If they match, the file is intact and unmodified. Most major Linux distros publish SHA-256 alongside ISOs for this purpose.
• Webhook signature verification — GitHub, Stripe, Slack sign each webhook payload with HMAC-SHA-256. The receiver computes the same HMAC and compares. See our Webhook Secret Generator for the keys; this tool is for the digest itself.
• Content-addressed storage — IPFS, Git, and many caching systems use a hash of content as its address. Two pieces of identical data automatically dedupe.
• Compare-without-revealing — store a SHA-256 of an email address to check membership in a list without storing the address itself. Adds privacy at the cost of being able to look up the original.
• Pre-image detection — when you suspect data has been tampered with, hashing the current state and comparing against an old hash is the fastest way to confirm.

What Hashes Cannot Do

• Hash passwords directly. SHA-256 is too fast. An attacker with a stolen hash database can compute billions of guesses per second on a single GPU. Always use a slow, salt-aware password hash: bcrypt, scrypt, or Argon2. Argon2id is the current OWASP recommendation.
• Encrypt data. A hash cannot be reversed; if you need to retrieve the data later, use AES-256-GCM, ChaCha20-Poly1305, or libsodium. Hashes are for verification only.
• Authenticate messages on their own. Use HMAC (Hash-based Message Authentication Code), which combines a hash with a secret key. HMAC-SHA-256 is the standard primitive for webhook signing and JWT signing.

Doing It in Code

// Browser (modern)
async function hash(s) {
  const buf = new TextEncoder().encode(s);
  const digest = await crypto.subtle.digest('SHA-256', buf);
  return [...new Uint8Array(digest)].map(b => b.toString(16).padStart(2,'0')).join('');
}

// Node.js
import { createHash } from 'crypto';
createHash('sha256').update(input).digest('hex');

// Python
import hashlib
hashlib.sha256(b'hello').hexdigest()

// Bash
echo -n 'hello' | sha256sum
shasum -a 256 file.bin                  // macOS/Linux
certutil -hashfile file.bin SHA256       // Windows

For HMAC (signing with a secret key), see our HMAC Generator. For specifically MD5 or SHA-256 in a single dedicated page, see MD5 or SHA-256.