Developer guide
How to generate a hash from text
To generate a reproducible hash, choose an algorithm, preserve the exact input bytes, and compare digests created with the same text encoding and normalization.
Open the Hash GeneratorWhat a cryptographic hash does
A hash function maps any input to a fixed-length digest. The same bytes with the same algorithm produce the same digest, while even a small input change should produce a very different result.
A digest cannot be decoded back to the original text. That does not make plain hashing suitable for password storage or secret protection.
SHA-256("hello") = 2cf24dba5f...938b9824
How to generate a hash
- Choose SHA-256, SHA-384, or SHA-512 according to the consuming system.
- Paste the exact text, including spaces and line endings.
- Select Generate hash.
- Copy the lowercase hexadecimal digest.
- Compare it only with a digest made from identical bytes and the same algorithm.
The ToolPixels generator converts text to UTF-8 and uses the browser Web Crypto API. Empty text is valid and has a defined digest.
Choosing an algorithm
| Algorithm | Digest length | Guidance |
|---|---|---|
| SHA-256 | 64 hex characters | Common modern default |
| SHA-384 | 96 hex characters | Use when a protocol requires it |
| SHA-512 | 128 hex characters | Use when a protocol requires it |
| SHA-1 | 40 hex characters | Legacy compatibility only |
SHA-1 is not collision-resistant enough for modern security uses. Do not choose an algorithm only because its output is shorter.
Why matching hashes differ
- A trailing newline is an extra byte.
- Windows and Unix line endings differ.
- Visually identical Unicode text can use different normalization forms.
- Uppercase and lowercase letters are different bytes.
- One system may hash file bytes while another hashes a displayed string.
When verifying data, define the byte encoding and normalization rules alongside the algorithm.
Hashes are not every security tool
A plain digest does not authenticate who created a message. Use an HMAC or digital signature for authenticity. Passwords need a dedicated, salted, deliberately slow password-hashing function such as Argon2, scrypt, or bcrypt.
Hashes are useful for checksums, content identifiers, cache keys, and protocol fields when applied according to the relevant specification.
Try it with ToolPixels
Generate lowercase hexadecimal SHA digests from UTF-8 text locally with Web Crypto.