SHA Hash Generator
Generate a SHA hash (SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512) of any text, in hexadecimal or base64, and optionally verify it against an expected hash.
Input
Hex comparison is case-insensitive; base64 is case-sensitive.
Output
Only shown when an expected hash is provided.
Guides
Paste any text and get its SHA hash instantly. Pick the variant you need — SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256 or SHA3-512 — and the output format (lowercase hex, uppercase hex, or base64). Paste a hash you already have into "Expected hash" and the tool tells you whether the two match.
Everything runs in your browser. The text you type is never uploaded, logged, or sent to a server.
Which SHA should I use?
SHA-256, unless you have a specific reason not to. It is the current default across TLS certificates, Bitcoin, Git's newer object format, package checksums and code signing. It is fast, unbroken, and universally supported.
- SHA-512 is not "more secure than SHA-256" in any way that matters — both are far beyond brute-force reach. It is, however, often faster on 64-bit CPUs, and it is the right choice when a spec asks for it.
- SHA-384 is SHA-512 truncated; it appears mostly in TLS cipher suites and some government profiles.
- SHA-224 is rare. Use it only if something you are talking to requires it.
- SHA3-256 / SHA3-512 are a structurally different design (Keccak sponge, not Merkle–Damgård). They are not a replacement for SHA-2 — SHA-2 is not broken — but they are a hedge: an attack on one family is unlikely to affect the other.
Is SHA-1 safe?
No. SHA-1 is broken for collision resistance — the SHAttered attack (2017) produced two different PDFs with the same SHA-1 hash, and the cost has only fallen since. Browsers stopped trusting SHA-1 certificates years ago.
It is included here because real systems still emit it and you sometimes need to reproduce their output: Git object IDs, older certificates, legacy APIs, {SHA} entries in htpasswd files. Reproducing a digest is fine. Relying on SHA-1 for new security decisions is not.
SHA-2 vs SHA-3 — what is the actual difference?
SHA-1 and SHA-2 (SHA-224/256/384/512) share a common lineage, so a breakthrough against the underlying construction could plausibly threaten both. SHA-3 was standardised precisely as insurance: it is built on a completely different primitive. In practice SHA-2 remains secure and is the pragmatic default; SHA-3 is what you reach for when a specification names it, or when you want algorithm diversity.
Why does my hash differ from another tool's?
Usually a trailing newline (hello and hello\n hash differently — command-line tools often include it), or a character-encoding mismatch. This tool encodes text as UTF-8 before hashing, which is what essentially all modern systems do.
Need a different algorithm?
Use the MD5 Hash Generator for MD5, or the general Hash Generator for everything including RIPEMD-160. For a keyed hash, use the HMAC Generator.