Toolivaro

Free Hash Generator

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes locally with WebCrypto — hex and base64 output, nothing uploaded.

The hash generator computes SHA digests of any text entirely in your browser, using the WebCrypto implementation built into every modern browser and Node.js — the same crypto.subtle.digest your own code would call, so the result is identical to what your application produces, with no third-party implementation in between. Choose SHA-256, SHA-384, or SHA-512 for anything you care about: file integrity checks, API request signing, storing verification values, or computing a stable identifier for a string. SHA-1 is also available for legacy interop — verifying an old checksum or matching a vendor format — and the tool labels it honestly as deprecated because the collision attacks against it are public and practical; you will not find SHA-1 presented as a security recommendation here. Input is encoded as UTF-8, the encoding web forms and fetch bodies use, so multibyte text like "café" or "日本語" hashes exactly as it would in your code. Two outputs are shown for every digest: lowercase hexadecimal, the format checksum tools and most documentation use, and base64, the compact form used inside JWTs, database columns, and API payloads — they describe the same bytes, which the page demonstrates. The whole computation runs locally: your text is never uploaded, logged, or stored, so the tool is safe for secret material you would not paste into a web service. Use it when you need to reproduce a checksum, compare a password verifier you cannot read, or confirm that two systems agree on a hash.

Processed locally in your browser

Encoded as UTF-8 — exactly the bytes your code would hash.

How is the result calculated?

Reproducing a checksum your colleague pasted

A colleague shares a download link and the SHA-256 checksum b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 for the file. To verify the value yourself, hash the exact text "hello world": the tool returns that same digest in hex, and its base64 form — the identical bytes in the compact encoding used inside JWTs and API payloads.

Input Value
algorithm SHA-256
text hello world
Result b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

What is the formula and its assumptions?

Secure Hash Algorithm

hash = SHA-{1|256|384|512}(UTF-8(text))

Symbol Meaning
SHA-{…} the cryptographic hash functions standardized in FIPS 180-4; each maps any input to a fixed-size digest (160, 256, 384, or 512 bits)
UTF-8(text) the input encoded as UTF-8 bytes before hashing

The tool does not implement the algorithms — it calls crypto.subtle.digest, the platform implementation, so the output is engine-faithful by construction.

Hex and base64 output

hex = lowercase base-16 of digest bytes; base64 = base-64 of the same bytes

Symbol Meaning
base-16 each digest byte as two hex digits (e.g. 0x2f → "2f")
base-64 the standard Base64 alphabet with padding, as in JWTs and database blobs

Both outputs encode the identical digest — verify by decoding either back to bytes.

What are the most common mistakes?

  • Hashing with SHA-1 and assuming it is secure — collision attacks are practical; use SHA-256 or stronger for anything new.
  • Comparing hashes across different encodings or with stray whitespace/newlines — the tool hashes exactly the bytes you paste, UTF-8, nothing added.
  • Using a plain digest of a password for storage — digests need key derivation (bcrypt/scrypt/Argon2) with a per-user salt.

What are the assumptions and limitations?

  • Digests only — this is not encryption and cannot recover the original input.
  • SHA-1 is offered for legacy interop but is collision-unsafe and labelled deprecated.
  • Input is treated as UTF-8 text; the tool does not hash raw files (only text you paste).

Where do the numbers come from?

Last reviewed August 12, 2026 · Version 1.0.0 · Toolivaro does not guarantee external content.

Developer Password Generator Generate strong passwords locally with cryptographically secure randomness — unbiased sampling, class guarantees, zero uploads. Developer JWT Decoder Decode JWT header, payload, and claims locally — with optional HMAC signature verification. Nothing leaves your browser. Developer Base64 Encoder & Decoder Encode text or files to Base64 and decode back, with UTF-8 handling, validation, and size stats — fully local.

Frequently asked questions

Is hashing the same as encryption?

No. Hashing is one-way: it produces a fixed-size fingerprint from which the original input cannot be recovered. Encryption is reversible with the key. The tool hashes only — it cannot (and must not claim to) encrypt anything.

Why is SHA-1 marked deprecated?

SHA-1 collision attacks are public and practical — since 2017, researchers have demonstrated collisions on real hardware. It is offered only for legacy interop (verifying old checksums, matching vendor formats) and is labelled as such. For anything new, use SHA-256 or stronger.

Can I use this to store passwords?

Not directly. Storing raw SHA-256 of a password is what password databases used to do — and attackers love it because unsalted hashes of weak passwords reverse instantly. Password storage needs a key-derivation function like bcrypt, scrypt, or Argon2 with a per-user salt. This tool computes plain digests for data integrity, not for password storage.

Is my input sent anywhere?

No. The digest is computed by the browser's WebCrypto implementation on your device. Nothing is uploaded, logged, or stored, which makes the tool safe even for strings you would not paste into a web service.

Why does the same text sometimes produce different results on other sites?

Encoding. "café" hashed as UTF-8 bytes differs from the same word in Latin-1, or with a trailing newline. This tool encodes input as UTF-8 with no added newline or whitespace, matching what your code produces — check what encoding the other tool used before trusting a mismatch.

Part of Password, hashing, and security tools

Found a mistake or have a correction? Report it — we review every correction.

Was this helpful?

Reviewed by the Toolivaro editorial team per our methodology Methodology · Editorial policy