About cryptographic hashes
A cryptographic hash function takes any input and produces a fixed-length string of hexadecimal digits. Even a tiny change in the input completely changes the output. This makes hashes useful for verifying file integrity, storing passwords and digital signatures.
SHA-256 and SHA-512 are part of the SHA-2 family and remain secure for most uses today. SHA-1 is considered weak against collision attacks and is included here for compatibility and legacy purposes only. MD5 is not available in this tool because browser security policies restrict it through the Web Crypto API.
How do I generate a SHA hash of text?
To generate a SHA hash, feed the UTF-8 bytes of the text into the chosen hash algorithm (SHA-1, SHA-256, SHA-384, or SHA-512), which processes the data through fixed rounds of bitwise operations and outputs a fixed-length digest as hexadecimal. Example: the SHA-256 hash of "hello" is always 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
Steps to generate a cryptographic hash
- Convert the input text to bytes using UTF-8 encoding.
- Choose a hash algorithm: SHA-1 (160-bit output), SHA-256 (256-bit), SHA-384 (384-bit), or SHA-512 (512-bit).
- Pass the bytes through the algorithm's compression function, which runs in fixed rounds regardless of input length.
- The algorithm outputs a fixed-length binary digest — 20 bytes for SHA-1, 32 for SHA-256, 48 for SHA-384, 64 for SHA-512.
- Convert the binary digest to a lowercase hexadecimal string for display, using two hex characters per byte.
Hash output lengths
SHA-1 = 160 bits (40 hex chars) | SHA-256 = 256 bits (64 hex chars) | SHA-384 = 384 bits (96 hex chars) | SHA-512 = 512 bits (128 hex chars)
- Digest = the fixed-length output of a hash function, shown here as lowercase hexadecimal
- Any change to the input, even one character, produces a completely different digest (the avalanche effect)
Example hashes of the text "hello"
| Algorithm | Hash of "hello" |
|---|
| SHA-1 | aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d |
| SHA-256 | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
| SHA-384 | 59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f |
| SHA-512 | 9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043 |
Frequently asked questions
Is SHA-1 safe to use?
SHA-1 is not safe for security purposes such as digital signatures or certificate validation, because researchers demonstrated a practical collision attack in 2017 (two different inputs producing the same hash). It is included here only for compatibility with legacy systems and non-security uses like simple checksums; use SHA-256 or higher for anything security-sensitive.
Why isn't MD5 offered in this tool?
This tool uses the browser's built-in Web Crypto API (crypto.subtle.digest), which supports SHA-1 and the SHA-2 family but does not implement MD5, since MD5 is considered cryptographically broken and browser vendors have not added it to the standard API.
Can I reverse a hash back to the original text?
No. A cryptographic hash function is a one-way function by design — there is no algorithm to recover the input from the digest. Tools that appear to "crack" hashes actually work by hashing large lists of guesses and comparing the results, not by reversing the math.
What is a hash used for if it can't be reversed?
Hashes verify that data has not changed: comparing the hash of a downloaded file to a published hash confirms integrity, and comparing hashes of passwords (with proper salting) lets a system check a login without storing the plain-text password.
This tool hashes UTF-8 text entirely in your browser using the Web Crypto API; it does not hash uploaded files, does not offer MD5, and does not add a salt, so identical input text always produces the identical hash shown here.
Sources: FIPS 180-4 - Secure Hash Standard (SHS)
Privacy and safety
- Runs in your browser — Everything you type is calculated on your own device. Your inputs are never sent to a utilduck server.
- Encrypted connection — Pages are served over HTTPS, so nobody on the network can read what you load.
- Not shared with third parties — Your inputs are not passed to analytics or advertising services.
- Nothing is stored — Results are not saved to any server, and there is no account to create.
Last updated: 2026-08-17