Cryptographic hash functions map arbitrary-length input to a fixed-length output in a one-way, deterministic process. The SHA-2 family (SHA-256, SHA-512) is specified in FIPS PUB 180-4 and forms the backbone of TLS certificates, code signing, Git commit identifiers, and API request signing. MD5 (128-bit) and SHA-1 (160-bit) remain common for non-security checksums despite being collision-vulnerable. SHA-256 (256-bit) is the current minimum recommendation for security applications; SHA-512 provides additional collision resistance for high-security contexts.
Hashing in the browser uses the Web Crypto API's SubtleCrypto.digest() method, which is implemented natively in all modern browsers and runs in a separate thread to avoid blocking the main UI. The method accepts an algorithm name ("SHA-256", "SHA-512") and an ArrayBuffer of the input data, and returns a Promise resolving to an ArrayBuffer of the hash output.
For text input, the input string is encoded to UTF-8 bytes using TextEncoder before being passed to digest(). For file input, the file is read as an ArrayBuffer using FileReader.readAsArrayBuffer() and passed directly.
MD5 is not part of the Web Crypto API (intentionally omitted due to its deprecated security status), so the tool implements MD5 in pure JavaScript using the RFC 1321 specification for completeness. The SHA variants use the native implementation.
Hash output is converted from ArrayBuffer to a hexadecimal string by mapping each byte to its two-digit hex representation.
A developer verifies the SHA-256 checksum of a downloaded binary matches the hash on the official release page before installing it on a server.
A backend developer generates an MD5 hash of a large file to use as a cache key or ETag value for HTTP caching.
A security engineer checks whether two versions of a configuration file are identical by comparing their SHA-256 hashes without doing a manual diff.
A developer generates SHA-512 hashes of sensitive log entries before archiving them to create a tamper-evident audit trail.
Scope note: This tool is suitable for checksums and non-security hashing tasks. For password storage, use a purpose-built password hashing function (bcrypt, scrypt, or Argon2) — not SHA-256 or SHA-512 directly, as they are too fast and lack a cost factor. For HMAC signatures, the JWT Decoder and HMAC tools provide the appropriate interface. Avoid pasting sensitive data in shared or screen-shared environments even though no server transmission occurs.
Type text or upload a file to hash
All hash variants (MD5, SHA-1, SHA-256, SHA-512) are shown simultaneously
Click any hash to copy it
We packaged the .claude config that runs this site — 26 specialist agents, 14 workflow skills, and 6 rule files from 31 real production incidents. From $9.
Get the Claude Code Production Pack — $29