Hash Generator

When should you generate hashes?

Hashes are useful for checksums, API signing examples, cache keys, debugging, and comparing whether text content changed.

Hashes are one-way digests, not encryption. This tool does not store input and does not send generated hashes anywhere.

How SHA hashing works

SHA-256, SHA-384, and SHA-512 belong to the SHA-2 family defined in FIPS 180-4. Each takes an input of any length and produces a fixed-size digest, a short string that changes completely if even one byte of the input changes. SHA-384 is not an independent algorithm; it runs the same 512-bit compression function as SHA-512 with different initial constants, then truncates the internal state to 384 bits before output.

This generator computes digests with the browser SubtleCrypto interface, part of the Web Crypto API, by calling crypto.subtle.digest() with the selected algorithm name and the UTF-8 bytes of the text entered. SubtleCrypto is only available in a secure context, meaning an HTTPS page or localhost during development. On a plain HTTP origin the API is undefined and the tool reports that Web Crypto is unavailable instead of silently failing.

Digest length is fixed by the algorithm, not by the input. A one-character input and a 10,000-character input hashed with the same algorithm always produce a digest of the same length, shown here as lowercase or uppercase hexadecimal.

Being broken for collision resistance means it is practical to deliberately construct two different inputs that share the same digest. It does not mean an attacker can take an existing hash and recover the original text; preimage resistance is a separate property, and both MD5 and SHA-1 still resist that in practice. For an accidental-corruption checksum, where nobody is deliberately crafting a colliding file, MD5 and SHA-1 still catch random bit errors reliably. For anything security-relevant, such as confirming a file was not tampered with or signing data, SHA-256 or a stronger algorithm is the safer choice, which is why MD5 and SHA-1 are not offered here.

Worked examples

These digests were generated with SHA-2 and can be reproduced with this tool or with a standards-compliant implementation such as openssl dgst or a language crypto library.

Comparing the first two rows shows the avalanche effect: capitalizing one letter turns hello into Hello and changes every character of the SHA-256 output. The two digests share no visible pattern, which is intentional, since a hash function that produced similar output for similar input would be useless for checksums or integrity checks. The empty-string row is a common sanity check when testing a new hashing setup, because every conforming SHA-256 implementation must return that exact value for empty input.

Limits and gotchas

• Text input only. The input box accepts pasted or typed text, not a file picker, so hashing a file requires opening it as text first. This works cleanly for plain-text files, but binary files such as images cannot be pasted in without corrupting the byte sequence.
• Character count and byte count can disagree. The character counter reflects the JavaScript string length, which counts UTF-16 code units, while the byte counter reflects UTF-8 encoded length. An emoji or a character outside the Basic Multilingual Plane can count as 2 in the character total but 4 in the byte total, and the digest is always computed over the UTF-8 bytes, not the UTF-16 units.
• Trailing whitespace changes the result. A stray trailing newline or space pasted into the box produces a different digest than the string without it, even though the difference is invisible in the textarea.
• Secure context required. SubtleCrypto is unavailable outside HTTPS or localhost, so this tool cannot generate a hash if it were somehow loaded over plain HTTP.
• No MD5 or SHA-1. A checksum published by a legacy system as MD5 or SHA-1 cannot be reproduced here; only SHA-256, SHA-384, and SHA-512 are offered.
• One-way only. There is no decode or reverse function by design. A hash cannot be turned back into its input, so this tool cannot recover text from a digest.

Frequently Asked Questions

Is this Hash Generator free?

Yes. You can generate and copy SHA hashes without signup.

Is my text sent to ConvertUnlimited servers?

No server-side upload endpoint is used for hashing; text is processed locally in your browser through the Web Crypto API.

Which algorithms are supported?

SHA-256, SHA-384, and SHA-512, computed with the browser SubtleCrypto interface. MD5 and SHA-1 are not offered.

Can hashes be reversed?

No. SHA-2 digests are one-way; there is no supported method to recover the original text from a digest alone.

Does it support Unicode?

Yes. Text is encoded as UTF-8 before hashing, so emoji, accented letters, and non-Latin scripts are hashed correctly.

Why do SHA-256, SHA-384, and SHA-512 outputs have different lengths?

Digest length is fixed by the algorithm rather than the input: 64 hex characters for SHA-256, 96 for SHA-384, and 128 for SHA-512, regardless of how long or short the source text is.

Can I hash a file instead of pasting text?

Not directly. This tool takes text input only; hashing a binary file requires a different workflow that reads file bytes rather than pasting content into a textarea.

Why did changing one character completely change the hash?

This is the avalanche effect. SHA-2 is designed so a one-bit change in the input flips roughly half the output bits, which is why hello and Hello produce SHA-256 digests that share no visible pattern.

Privacy

Privacy build: This build removes ads, analytics, remote fonts, runtime CDN scripts, and file-operation telemetry. Selected files are processed in the browser using local JavaScript and browser APIs.

ConvertUnlimited does not provide a server-side upload endpoint for this hashing flow. Text input is processed locally in your browser.

Terms of Use

ConvertUnlimited is provided as is. Do not treat hashes as password storage guidance or encryption.