Hash Generator: SHA-256, SHA-384, SHA-512 and SHA-1

What is a hash generator?

A hash generator takes any text and runs it through a one-way algorithm to produce a fixed-length string, the hash, that acts as a fingerprint for that exact input. Change one character and the fingerprint changes completely; feed the same text in again and you get the identical result every time. This tool covers the algorithms you actually need a hash generator for today: SHA-256, SHA-384, SHA-512, and SHA-1, all computed by the browser itself.

The typical reason someone reaches for a sha256 generator is to confirm that a piece of text matches what it's supposed to be, whether that's checking a value against a checksum published alongside a download, generating a fingerprint for a config value, or just seeing how hashing behaves. There's no upload and no account: paste the text, read the hash, done.

How to use it

1. Choose an algorithm. Pick SHA-256, SHA-384, SHA-512 or SHA-1 from the pills at the top. SHA-256 is selected by default, and the SHA-1 pill carries a broken badge, since it's kept only for checking old published checksums, not for anything new.
2. Type or paste your text. Enter it in the input box and the hash appears in the read-only output box below as you type. The counts row underneath — Characters, Bytes and Digest size — updates alongside it.
3. Copy or compare. Click Copy to grab the hex digest (it reads Copied! for two seconds), tick Uppercase if you need capital letters, or paste a checksum you were given into the Compare with a known hash field to see whether it matches.

What a hash actually guarantees

The output length never moves with the input. A single character and a million-character string both produce exactly 64 hex characters out of SHA-256, 96 out of SHA-384, 128 out of SHA-512, or 40 out of SHA-1. That fixed width is what makes a hash a fingerprint rather than a compressed copy of the data, and it's also why hashing can never be undone by computation: a million characters cannot be recovered from 64.

Small changes should produce unrelated-looking output, and that was measured rather than assumed here: changing one character flips 50.0% of the 256 output bits, averaged across 200 pairs of inputs. Hashing “hello” gives 2cf24dba5fb0a30e…, while “hellp”, one letter later in the alphabet, gives fdd7585e08c4e2af… — nothing about the two digests looks related. Run the same input fifty times and you get exactly one distinct result each time; there's no randomness anywhere in the process.

The hashes themselves come from the browser's built-in SubtleCrypto, not a hand-written implementation on this page. Every digest was cross-checked against Node's crypto module, a completely separate implementation, across 48 digests spanning all four algorithms and inputs including emoji, Arabic, Japanese and a 10,000-character string. All 48 matched, and so do the published test vectors: SHA-256 of “abc” is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, and SHA-1 of “abc” is a9993e364706816aba3e25717850c26c9cd0d89d.

Why there's no MD5 here

The most useful thing about this page might be what it doesn't offer. MD5 is missing, and that's not an oversight: the Web Crypto specification never included it. Call crypto.subtle.digest with MD5 in any browser and it throws. That's a deliberate refusal to hand developers a broken primitive under a friendly name. Node's own crypto module still offers md5 for legacy compatibility, but this tool inherits the browser's refusal rather than shipping a hand-written MD5 just to capture the search traffic for it.

SHA-1 is different: it's offered, but the pill is labelled broken on purpose. Checking an old published checksum against a SHA-1 value is still a real job people need to do. What SHA-1 can no longer do is prove two files are genuinely identical — in 2017, researchers published two different PDF files that share the same SHA-1 digest. Use it to match against a legacy checksum; never use it to prove two things are the same.

A few honest limitations matter more on this page than on most. A fast hash is the wrong tool for passwords: SHA-256 is built for speed, which is exactly what an attacker guessing billions of passwords a second wants, and password storage needs a deliberately slow, salted algorithm like bcrypt, scrypt or argon2 instead — never store a plain SHA-256 of a password. Hashing is also not encryption; there's no key and nothing to decrypt, and for a short or common input, reversing a hash isn't a cryptographic break, it's a lookup in a table someone precomputed years ago. And this tool hashes text, not files — it can't verify a download by reading the file itself, so paste the text or reach for a command-line tool for actual files. Nothing you type is uploaded or saved; reload the page and the box is empty again.

Why is it free?

Everything on this page runs in your browser, using the browser's own cryptography, so there's no server to pay for and no reason to charge you. No account, no watermark on the output, no paid tier hiding an algorithm behind a paywall. That's true of every tool on FreeToGenerate.com: they run locally, cost nothing to offer, and stay free for the same reason.