Hash Generator

How the digests are computed

The text is first encoded to UTF-8 bytes with TextEncoder, then passed to crypto.subtle.digest, the SubtleCrypto part of the Web Crypto API that ships in every modern browser. The resulting bytes are printed as lowercase hexadecimal, two characters per byte. All four algorithms run on every click, so there is no algorithm picker to set.

Worked example: the sample text

Click Generate hashes without changing anything and you should see exactly these values. Any difference means the text was altered, for example by a trailing space.

Why one character changes everything

A good hash function has the avalanche property: flipping a single input bit changes about half the output bits. The SHA-256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, while Hello with a capital H gives 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969. The two share nothing recognisable.

Invisible characters count too. Adding a line break after hello produces 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03. This is the usual reason a hash computed here fails to match one from a command line: echo appends a newline unless you pass -n. The hash of an empty box is also well defined; SHA-256 of nothing is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.

What this hash tool cannot do

• MD5 is not offered. SubtleCrypto has never implemented it, and the widget includes no JavaScript fallback, so an MD5 checksum from an old download page cannot be reproduced here.
• Files cannot be hashed. Only the characters in the text box are hashed, so pasting the contents of a file hashes that text as UTF-8, which only matches the file's checksum if the file is plain UTF-8 text with identical line endings.
• Windows line endings are normalised. A textarea converts CR LF pairs to LF, so text copied from a Windows file hashes differently from the file on disk.
• There is no HMAC, no salt and no key input, and no password-hashing functions such as bcrypt or Argon2. Plain SHA-256 is the wrong tool for storing passwords.
• Output is lowercase only. Many tools print uppercase hex; compare case-insensitively.

Reading a hash you have been given

The length of a hex digest tells you which algorithm made it: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. To check a value against this tool, paste the exact original text, generate, and compare the row of matching length. For verifying a downloaded file, use your operating system instead: certutil -hashfile on Windows, shasum -a 256 on macOS or sha256sum on Linux, because those read the raw bytes.