A hash generator turns an input into a fixed-size digest. This hash generator uses the browser’s Web Crypto digest API. Supported algorithms are SHA-256, SHA-384, SHA-512, and SHA-1. SHA-1 is labeled legacy. It is here to check an old checksum, not to protect a password. MD5 is not implemented because Web Crypto does not provide it and this batch will not add a second hash library.
Hashing is one-way for these algorithms in ordinary use. You cannot “decrypt” a SHA-256 hex string back into the original text. That is the usual confusion with encryption. Encryption has a key and is meant to be reversed by the holder of that key. A hash has no key on this page. Do not store user passwords as a bare SHA-256 of the password. That is not a password-hashing scheme.
Input is encoded as UTF-8 before digest. The same letters with a combining mark and a precomposed character can hash differently. That is Unicode, not a bug in the page. Nothing is uploaded. This is independent of the JSON tools: hashing a JSON document is just hashing text.
Input over 200,000 characters is refused. Labels sit above the boxes. The digest is lowercase hex. Enter from the algorithm list runs the hash.
SHA-256 of abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. SHA-256 of an empty box is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. A string that looks like a script tag is hashed as those characters, not executed. The output box is text.
SHA-256("abc") = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adIf two files hash the same under SHA-256, they are the same bytes for practical purposes. If you needed a keyed MAC, this page is the wrong tool. If you needed to pretty-print JSON before hashing, format it first on the JSON Formatter, then paste the exact bytes you intend to digest. Whitespace is part of the input.
SHA-1 collisions are a known academic and practical fact. Do not use SHA-1 for new integrity designs. It remains because old manifests still print it. SHA-256 is the default on the form for that reason.
The page will not compare two files for you and will not walk a directory. One string in, one digest out. That is the whole job.
Line breaks are part of the input. Windows CRLF and Unix LF hash differently if you paste both. That surprises people who thought “the same paragraph” was the same bytes. If a published checksum was made on a file, hash the file bytes, not a retyped sentence. This page hashes exactly what is in the box.
Unicode astral characters become UTF-8 multi-byte sequences. The digest is of those bytes. Two visually similar names from different scripts are different inputs. The page will not normalize to ASCII. If you needed NFKC first, do that before you paste.
One-way digest via Web Crypto, UTF-8 bytes. This is not encryption and not a password-storage scheme. SHA-1 is listed only as a legacy check.
No. These digests are one-way. There is no key and no decrypt step.
SHA-1 is broken for collision resistance. Use it only to match an old checksum.
No. Web Crypto does not provide MD5, and this page will not invent it.
Yes. SHA-256 of empty input is the published empty digest.