Tools / Hashes

SHA-1, SHA-256, SHA-384, SHA-512 hash calculator

All four digests are computed at once with the browser’s SubtleCrypto. Text is hashed as UTF-8. A file is read locally and never leaves the page.

Text

Or a file

Output format

Compare with an expected digest

Reference values

For the three bytes abc, SHA-256 is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Use it to check that a pipeline hashes what you think it hashes. A trailing newline from echo changes everything; printf %s abc | sha256sum matches, echo abc | sha256sum does not.

About SHA-1

SHA-1 is broken for collision resistance: two different inputs with the same SHA-1 have been produced in practice. Do not use it for signatures, certificates or anything where an attacker can choose the input. It is listed here because git object ids and many older checksum files still use it. For new work use SHA-256 or SHA-512.

Pitfalls

A plain hash is not a password hash. SHA-256 runs billions of times per second on a GPU, so stored password digests fall quickly. Passwords need a slow, salted function such as Argon2id, scrypt or bcrypt. SubtleCrypto offers PBKDF2, which is acceptable with a high iteration count.

SubtleCrypto is only available on https pages and on localhost. The file is read into memory in full, so files above 512 MB are refused.