Hash Generator

Generate SHA-2 hashes and HMACs from text.

Input

SHA-256 Hash

A cryptographic hash function takes any input and produces a fixed-length fingerprint. The same input always produces the same hash; even a single character change produces a completely different output. This makes hashes useful for verifying data integrity, generating checksums, and storing passwords.

This tool uses the browser's built-in crypto.subtle.digest API, part of the Web Crypto standard. All three algorithms here belong to the SHA-2 family: SHA-256 produces a 256-bit (64 hex character) digest, SHA-384 produces 384 bits, and SHA-512 produces 512 bits. Longer digests provide more collision resistance.

MD5 and SHA-1 are intentionally excluded — both have known collision vulnerabilities and are no longer considered cryptographically secure. SHA-256 or higher is recommended for all new applications.

HMAC mode computes a keyed hash — HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512, as defined in RFC 2104 — with crypto.subtle.sign. It is what signs webhook payloads and API requests: both sides hold the same secret key, and only someone with it can produce the matching MAC. The key is read either as the UTF-8 bytes of the text you type or as hex, two digits per byte. It never leaves this page: the link format below has no place for it, and nothing you type here is written to the address bar.

For key derivation, or hashing the output of another step, use CyberChef. It chains operations into a recipe, runs locally in your browser, and is free and open source with no account, though its page runs Google Analytics. For checksumming a large file off disk, stay here — File Checksum streams it rather than loading it into a recipe.

Link to this tool with values filled in

Everything after the # stays in your browser — it is never sent to a server — so a link like this opens the tool ready to go without the values travelling anywhere but the address bar:

https://crunchify.net/tools/hash#text=hello&algorithm=SHA-256

Join the settings with &, and percent-encode each value so that spaces, newlines and any #, &, = or % inside one do not break the link. Leave a setting out to accept its default. If a setting is not recognised, the page says so rather than quietly ignoring it.

text (also input, value, q or string) — text, up to 1024 characters, required. The text to hash.
algorithm (also algo or hash) — SHA-256, SHA-384 or SHA-512, defaults to SHA-256. SHA-2 only. MD5 and SHA-1 are deliberately not offered.
format (also encoding or output) — hex, base64 or base64url, defaults to hex. How to render the digest bytes.

The tool reads these on arrival but never writes them back, so what you type here stays out of your browser history.

What is a hash and what is it used for?

A cryptographic hash function produces a fixed-length fingerprint (digest) from any input. The same input always gives the same hash; any change in input gives a completely different hash. Uses: verifying file integrity, storing passwords safely, generating checksums, and digital signatures.

What is the difference between SHA-256, SHA-384, and SHA-512?

All three are in the SHA-2 family. SHA-256 produces a 256-bit (64 hex character) digest; SHA-384 produces 384 bits; SHA-512 produces 512 bits. Longer digests provide more collision resistance. SHA-256 is the most widely used; SHA-512 can be faster on 64-bit CPUs.

Why are MD5 and SHA-1 not included?

Both MD5 and SHA-1 have known collision vulnerabilities — it is computationally feasible to craft two different inputs that produce the same hash. They are no longer considered cryptographically secure for integrity checking or digital signatures.

Can I use a hash to store passwords?

Not raw SHA hashes — they are too fast, making brute-force attacks practical. For password storage, use a dedicated password hashing algorithm: bcrypt, scrypt, or Argon2. These are deliberately slow and include a salt to prevent rainbow table attacks.

How do I check a webhook signature with HMAC?

Switch to HMAC mode, pick the algorithm the sender documents (usually SHA-256), paste the shared signing secret as the key and the raw request body as the message. Compare the result with the signature header in the same encoding — most providers send hex, some base64. The body must be byte-for-byte what was sent: re-formatted JSON produces a different MAC.

How do I verify a file download using a hash?

The file provider publishes the expected hash (e.g., SHA-256: abc123...). After downloading, compute the hash of your file and compare. If they match, the file is intact and unmodified. Any difference means the file was corrupted or tampered with.

Updated October 12, 2026