Hash Generator

What is a hash used for?

A hash is a fixed-length “fingerprint” of data. The same input always produces the same hash, and changing even one character produces a completely different result. That makes hashes ideal for checksums (verifying a download wasn’t corrupted), integrity checks, and as building blocks in security systems.

These hashes are computed with your browser’s built-in Web Crypto engine, so your text never leaves your device. Note that hashing is one-way: you cannot turn a hash back into the original text. For random secrets, use the password generator.

What a hash function guarantees

A cryptographic hash maps any input to a fixed-length digest with three properties: the same input always gives the same output, you cannot work backwards from the digest, and finding two inputs with the same digest should be computationally infeasible. Change one bit of input and roughly half the output bits flip — the avalanche effect.

Verifying a download

Publishers post a checksum so you can confirm a file arrived intact and unaltered. Hash your copy, compare it with the published digest, and check the first and last several characters at minimum — ideally the whole string. A mismatch means a corrupted transfer or a tampered file; either way, do not run it. Note that a checksum published on the same page as the download only proves integrity, not authenticity — for that you need a signature.

Never hash passwords with SHA-256

This is the most common misuse. SHA-256 is designed to be fast, which is exactly wrong for passwords: a modern GPU can test billions of candidates per second. Password storage needs a deliberately slow, salted, memory-hard function:

• Argon2id — current first choice, tunable in memory and time.
• bcrypt — long-established and still sound with an adequate cost factor.
• scrypt or PBKDF2 — acceptable where the others are unavailable, with a high iteration count.

A per-user salt stops one precomputed table from attacking every account at once, and a slow function makes each guess expensive rather than free.

Hashing is not encryption

Encryption is two-way with a key; hashing is one-way with none. You cannot “decrypt” a hash. What attackers do instead is guess: hash enormous dictionaries of likely inputs and look for a match. Short or predictable inputs fall immediately, which is why hashing an email address does not anonymise it.