Hashing

How it works

This tool calls the Web Crypto API, specifically crypto.subtle.digest(), which browsers implement with the same hash functions OpenSSL and every other platform library use. The input is converted to bytes first: text is encoded as UTF-8, while the hex and base64 options let you hash an exact byte sequence. Everything happens in your browser; nothing is sent to a server.

Hashing is deterministic: the same bytes always produce the same digest, on every machine, forever. That is the opposite of the random string generator, and it is why hashes work as fingerprints for content. It also means a hash reveals nothing about the preimage except its length, but two files that hash the same are treated as identical.

SHA-1 is broken

Researchers published the first practical SHA-1 collision in 2017 (the SHAttered attack), and chosen-prefix collisions followed in 2020. Anything an adversary could influence, such as signatures, certificates, or integrity checks on untrusted content, needs a SHA-2 variant instead. SHA-1 lingers in legacy systems and Git object IDs (with collision-detection hardening), so it is worth recognizing, but default to SHA-256 here.

Hashes are not for passwords

These are fast, unkeyed hashes, and fast is exactly wrong for password storage. Modern GPUs can try billions of SHA-256 guesses per second against a leaked database, so a plain password hash falls to an offline attack in hours. Passwords need a deliberately slow, salted KDF built for the job: Argon2id, scrypt, or bcrypt.

When to use it

Good uses: integrity checksums, content addressing, cache keys, deduplication, and change detection. When verifying a download from someone else, prefer a signature over a bare hash: a checksum only proves anything if the channel it arrives on is trustworthy, and a signed release covers that.