Generate a cryptographic hash of any text — SHA-256, SHA-1, SHA-384, or SHA-512 — directly in your browser using the Web Crypto API. The hex digest updates as you type. Because hashing runs locally with no upload endpoint, you can hash secrets and tokens without sending them anywhere. Free, no signup, no ads on the tool.
A hash is a one-way fingerprint: the same input always produces the same digest, and there is no way to run the process backwards to recover the input. That makes hashes useful for verifying that a file or string hasn't changed — compare the digest you have against the digest you expect, and any difference at all, down to a single bit, produces a completely different output. It is not encryption, and a hash is not a way to hide data: short or predictable inputs can be recovered by simply hashing every candidate until one matches.
Enter your text
Type or paste the text you want to hash.
Pick an algorithm
Choose SHA-256 (the common default), SHA-1, SHA-384, or SHA-512. The hex digest updates instantly.
Copy the digest
Copy the resulting hex string. The hashing ran entirely in your browser.
Hashes text, not files
This tool digests the text in the box. To verify a downloaded file's checksum, hash the file itself with sha256sum, shasum -a 256, or CertUtil — hashing the filename or a pasted excerpt will not match the published checksum.
Line endings change the digest
A trailing newline, or Windows CRLF versus Unix LF, produces an entirely different hash. If your digest doesn't match a reference value, this is the usual reason — check for an invisible newline at the end of your paste.
SHA-1 is here for compatibility only
SHA-1 has practical collision attacks and should not be used for anything security-relevant. It remains available because older systems, legacy Git object IDs, and some vendor APIs still emit it and you may need to match one.
Which hash algorithms are supported?
SHA-256, SHA-1, SHA-384, and SHA-512 — all computed with the browser's native Web Crypto implementation.
Is my input sent anywhere?
No. The hash is computed locally via crypto.subtle.digest. There's no upload endpoint and no network request carries your text.
Why isn't MD5 offered?
Web Crypto doesn't provide MD5 (it's cryptographically broken), so GhostDev sticks to the SHA family the browser supports natively without pulling in third-party code.
Is the output the same as command-line sha256sum?
Yes — for the same UTF-8 bytes, the hex digest matches sha256sum / openssl dgst output exactly.
Can I hash a password with this?
You can, but a raw SHA hash isn't suitable for storing passwords — use a salted, slow KDF like bcrypt or Argon2 for that. This tool is for checksums and general hashing.
Does Unicode text hash correctly?
Yes. The text is encoded as UTF-8 before hashing, which is the same convention command-line tools use — so emoji and non-Latin scripts produce digests that match sha256sum on the same content.
What's the difference between SHA-256 and SHA-512?
Digest length and internal word size. SHA-512 produces a 128-character hex string versus SHA-256's 64, and is often faster on 64-bit hardware. Both are considered secure; SHA-256 is the more widely expected default.
Every GhostDev tool runs entirely in your browser. Your file is never uploaded — there's no upload endpoint to send it to.