Hash Generator

Generates SHA-1, SHA-256, SHA-384 and SHA-512 hashes from any text using the browser's Web Crypto API — nothing you type leaves your device. Useful for file checksums, integrity checks, and understanding hash properties for a security cert or a code review.

What makes something a hash function, specifically

• Deterministic — the same input always produces exactly the same output, every time
• One-way — there's no operation that reverses a hash back into its original input
• Avalanche effect — flip one character in the input and the entire hash changes, unrecognisably, not just the part near the change
• Collision resistant — finding two different inputs that hash to the same output should be computationally infeasible

Which algorithm actually applies where

• SHA-1 — deprecated. Known collision attacks exist. Still shows up in legacy certs and Git commit hashes, but shouldn't be chosen for anything new.
• SHA-256 — the current default. TLS 1.3, HTTPS certificates, code signing, most modern security protocols default here.
• SHA-384 / SHA-512 — used where a larger output or extra margin is specifically required — high-security government and financial systems, long-term integrity verification.

Where a plain hash is the right tool

• Verifying a downloaded file matches its published checksum before you trust it
• Deduplication in backup systems, matching identical content without storing it twice
• Generating ETag headers for HTTP caching
• Blockchain transaction verification

Where it's the wrong tool entirely

Passwords. A plain SHA-256 hash of a password is fast to compute, which is exactly the property you don't want here — it means an attacker with a leaked hash database can brute-force it at billions of guesses per second on ordinary consumer hardware. Password storage needs bcrypt, Argon2 or scrypt specifically, because they're deliberately slow and memory-hard in a way general-purpose hashes like SHA aren't. If a system stores passwords as plain SHA-anything, that's not a style choice, it's a vulnerability.