How to Generate a Hash (SHA-256 and Friends), Explained

Hashing turns any input into a fixed-length fingerprint — a short string that changes completely if the input changes even slightly. It's one of the most useful ideas in computing, underpinning integrity checks, fingerprints, and (with the right techniques) password storage. This guide explains what a hash is and how to generate one.

What is a hash?

A hash function takes any input — a word, a document, a whole file — and produces a fixed-length string of characters. The same input always produces the same output, but even a one-character change produces a completely different hash. Crucially, a good cryptographic hash is one-way: you can't reverse it to recover the original input.

For example, hashing "hello" with SHA-256 always gives the same 64-character result, while "Hello" (capital H) gives something entirely different. That sensitivity is exactly what makes hashes useful.

What hashes are used for

• Integrity checks. Publish a file's hash; anyone who downloads it can hash their copy and confirm it matches, proving it wasn't corrupted or tampered with.
• Fingerprints. Quickly check whether two inputs are identical by comparing their hashes instead of the full content.
• Deduplication. Identify duplicate files by hash.
• Password storage (with salting and a purpose-built algorithm) — never plain hashing alone.
• Digital signatures and certificates, which hash content before signing.

The algorithms, and why MD5 is dead

Our Hash Generator offers the SHA family:

• SHA-256 — the modern default. Fast, secure, and used everywhere from TLS to blockchains. When in doubt, use this.
• SHA-1 — older; still seen in legacy systems but no longer considered secure against determined attackers. Fine for non-security checksums, not for anything adversarial.
• SHA-384 / SHA-512 — longer variants for when you want extra margin.

You'll notice MD5 is absent — deliberately. MD5 is cryptographically broken: attackers can produce different inputs with the same hash (a "collision"), which defeats its security purpose. Modern browsers don't even provide it. For anything security-related, use SHA-256 or stronger.

How to generate a hash

1. Open the Hash Generator.
2. Type or paste your text.
3. See SHA-1, SHA-256, SHA-384, and SHA-512 update live.
4. Copy the one you need.

It's computed in your browser with the Web Crypto API, so your input is never uploaded.

Important: hashing is not encryption

This trips people up constantly. Encryption is reversible — with the key, you get the original back. Hashing is one-way — there's no key and no way back. Don't use hashing to "hide" data you need to recover later; that's what encryption is for. And don't store passwords with a plain hash — use a dedicated password-hashing algorithm with salting, which is designed to be slow and resist brute-forcing.

A worked example

Say you download a software installer and the site lists its SHA-256 hash. Paste the file's contents (or use a file checksum tool) and compare. If your hash matches the published one, the file is intact and unmodified. If it doesn't, something changed in transit — don't run it. That simple check is a genuine security habit.

Salting, and why you never store passwords with a plain hash

The single most important thing to understand about hashing and passwords is that a plain hash is not enough. If you hash every user's password with SHA-256 and store the result, two users with the same password get the same hash — and attackers have precomputed enormous tables ("rainbow tables") mapping common hashes back to their inputs. A stolen database of plain hashes can be cracked alarmingly fast.

The fix has two parts. First, salting: add a unique random value to each password before hashing, so identical passwords produce different hashes and precomputed tables become useless. Second, use a slow, purpose-built password-hashing algorithm (such as bcrypt, scrypt, or Argon2) rather than a fast general-purpose hash like SHA-256. Fast is good for checksums but bad for passwords — you want password hashing to be slow enough that brute-forcing millions of guesses is impractical.

So the SHA hashes this tool generates are perfect for integrity checks, fingerprints, and comparisons, but they are not the right tool for storing passwords. That job belongs to a dedicated, salted, deliberately slow algorithm on your server. Keeping that distinction clear is one of the marks of someone who understands security rather than just the mechanics of hashing.

Related tools

• Password Generator — create strong passwords.
• UUID Generator — generate unique IDs.
• Base64 Encode / Decode — encode and decode data.
• JWT Decoder — inspect JSON Web Tokens.

Verifying downloads: a habit worth forming

One of the most practical everyday uses of hashing is verifying downloads. Reputable software projects publish a checksum — often SHA-256 — next to their download links. After downloading, you compute the hash of your copy and compare it to the published one. A match means the file arrived intact and unaltered; a mismatch means it was corrupted in transit or, worse, tampered with, and you shouldn't run it. It takes seconds and is a genuine security practice, not paranoia — supply-chain attacks that swap a legitimate installer for a malicious one are real, and a checksum check is a simple line of defence that catches them.

Common questions

Which algorithms are supported? SHA-1, SHA-256, SHA-384, and SHA-512, all computed with the Web Crypto API.

Why is MD5 not included? MD5 is cryptographically broken and browsers don't provide it. Use SHA-256 or stronger.

Is my text uploaded? No. Hashing happens entirely in your browser.

What can I use hashes for? Verifying file or text integrity, generating fingerprints, and checking whether two inputs are identical.

Can I reverse a hash? No. Cryptographic hashes are one-way by design — that's the point.

The bottom line

A hash is a one-way fingerprint that's perfect for integrity checks and comparisons — with SHA-256 as the sensible default and MD5 firmly retired. Generate SHA hashes from text, live and privately, with our free Hash Generator.

---

Prime Webkit builds free tools like this. We also build AI assistants that can answer your team's technical and security questions on demand — trained on your own docs. Explore our AI Chatbot Builder.