Hash Generator
Generate SHA-256, SHA-384, or SHA-512 hashes from any text.
Written by Anil Gautam · Updated
What does a SHA-256 hash of text look like?
A hash is a fixed-length fingerprint of the exact bytes you enter. With SHA-256 selected, the word hello produces 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824: 64 hexadecimal characters, or 32 bytes. SHA-384 always returns 96 characters and SHA-512 returns 128, whether you hash one letter or a whole page.
One changed character produces a completely different digest. Spelled with a capital H, Hello gives 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969, with no visible link to the lowercase result. SHA-384 is a separate calculation with its own starting values, so its output never matches the first 96 characters of the SHA-512 digest for the same text.
Why doesn't my hash match the one from another tool?
The digest covers every byte, including invisible ones, and a trailing newline is a common cause of mismatches. In a terminal, echo "hello" | shasum -a 256 hashes hello plus a line break and prints 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03, while printf 'hello' | shasum -a 256 matches the 2cf24dba value above. A space or an empty line left at the end of the input box has the same effect.
Encoding matters too. The tool converts your text to UTF-8 bytes, and line breaks in the box are stored as LF, so the checksum of a file saved with Windows CRLF line endings will not match the hash of its text pasted here. Accented letters can be stored two ways: café typed with a single é character is 5 bytes, while café typed as e plus a combining accent is 6 bytes, and the two hash differently although they look identical. Letter case in the digest does not matter. Some programs print hex in capitals, and both forms represent the same number.
When is a SHA hash the right tool?
Hashes let two people confirm they hold identical text, such as a license key or an API payload, by comparing digests. They also make stable cache keys and IDs. The digest is calculated in your browser with the built-in Web Crypto API and updates as you type or switch algorithms. A hash does not hide short or predictable values, though: anyone can hash every possible phone number and look for a match.
Plain SHA hashes are a poor way to store passwords. They are fast, which lets an attacker test huge numbers of guesses, and no salt is added here; password storage needs a slow algorithm such as bcrypt or Argon2. No secret key is involved either, so the output is not an HMAC signature like the one in an HS256 JWT. The tool hashes typed or pasted text only, and MD5 and SHA-1 are not offered. For a downloaded file's checksum, use shasum -a 256 on macOS or certutil -hashfile on Windows.