#️⃣ SHA Hash Generator
One input, four hashes — SHA-1, SHA-256, SHA-384 and SHA-512, computed by your browser’s built-in crypto engine.
—
—
—
—
Computed with the browser's Web Crypto API (crypto.subtle) — the input never leaves your device. MD5 is intentionally absent: it's cryptographically broken and excluded from Web Crypto.
How the sha hash generator works
Hashes are computed with the Web Crypto API (crypto.subtle.digest) — the same audited implementation your browser uses for TLS, not a JavaScript reimplementation. The text is UTF-8 encoded, digested, and shown as lowercase hex. A hash is one-way: identical input always gives the identical digest, but the digest cannot be reversed to the input.
MD5 is deliberately absent: Web Crypto does not implement it because it has been cryptographically broken for two decades. If you need to match a legacy MD5 checksum, treat it only as an integrity spot-check, never as security. For verifying downloads, compare the published SHA-256 against the file’s hash character-for-character (the first and last 8 are usually enough to eyeball).
Frequently asked questions
Which SHA should I use?
SHA-256 is the modern default — checksums, signatures, content addressing. SHA-512 offers a larger digest (and is faster on some 64-bit systems). SHA-1 survives only for legacy comparisons: collisions have been demonstrated, so avoid it for anything security-relevant.
Why is MD5 not offered?
The browser’s Web Crypto API deliberately excludes it — MD5 collisions are practical to generate, so shipping it invites misuse. SHA-256 replaces it everywhere that matters.
Can a hash be decrypted?
No — hashing is one-way by construction. "Cracking" a hash means guessing inputs until one matches, which is why short passwords hash-crack quickly but long ones don't.
Is this suitable for hashing passwords?
No — password storage needs slow, salted algorithms (bcrypt, scrypt, Argon2). Plain SHA is for integrity and identification, not credential storage.
Does my text leave the browser?
No — hashing is local via crypto.subtle. That matters when the input is an API secret or private text.