#️⃣ SHA Hash Generator
One input, four hashes, SHA-1, SHA-256, SHA-384 and SHA-512, computed by your browser’s built-in crypto engine.
—
—
—
—
Computed with the browser's Web Crypto API (crypto.subtle), the input never leaves your device. MD5 is intentionally absent: it's cryptographically broken and excluded from Web Crypto.
How the sha hash generator works
Hashes are computed with the Web Crypto API (crypto.subtle.digest), the same audited implementation your browser uses for TLS, not a JavaScript reimplementation. The text is UTF-8 encoded, digested, and shown as lowercase hex. A hash is one-way: identical input always gives the identical digest, but the digest cannot be reversed to the input.
MD5 is deliberately absent: Web Crypto does not implement it because it has been cryptographically broken for two decades. If you need to match a legacy MD5 checksum, treat it only as an integrity spot-check, never as security. For verifying downloads, compare the published SHA-256 against the file’s hash character-for-character (the first and last 8 are usually enough to eyeball).
Frequently asked questions
Which SHA should I use?
SHA-256 is the modern default, checksums, signatures, content addressing. SHA-512 offers a larger digest (and is faster on some 64-bit systems). SHA-1 survives only for legacy comparisons: collisions have been demonstrated, so avoid it for anything security-relevant.
Why is MD5 not offered?
The browser’s Web Crypto API deliberately excludes it, MD5 collisions are practical to generate, so shipping it invites misuse. SHA-256 replaces it everywhere that matters.
Can a hash be decrypted?
No, hashing is one-way by construction. "Cracking" a hash means guessing inputs until one matches, which is why short passwords hash-crack quickly but long ones don't.
Is this suitable for hashing passwords?
No, password storage needs slow, salted algorithms (bcrypt, scrypt, Argon2). Plain SHA is for integrity and identification, not credential storage.
Does my text leave the browser?
No, hashing is local via crypto.subtle. That matters when the input is an API secret or private text.