Which hash should I use?

For integrity checks and general hashing, use SHA-256 - it is the modern default, fast and secure. SHA-512 is also strong and can be faster on 64-bit hardware. Avoid SHA-1 for anything security-sensitive; it is broken for collision resistance and shown here only because some legacy systems still use it. MD5 is not offered because it is cryptographically broken.

Can I use this to hash passwords?

No. Plain SHA hashes are far too fast for password storage - an attacker can try billions per second. Passwords need a slow, salted password hash like bcrypt, scrypt, or Argon2, run on your server. Use SHA-256 here for integrity, checksums, and content addressing, not for storing credentials.

No. Hashing runs entirely in your browser with the Web Crypto API - nothing you type is sent anywhere. You can disconnect from the network and it still works.

Free tool · Runs in your browser · Nothing uploaded

Hash any text.

Type text and get its SHA-256, SHA-1, SHA-384, and SHA-512 hashes instantly — computed with the browser’s Web Crypto, so nothing you type leaves your machine.

Input

SHA-256

—

SHA-512

—

SHA-384

—

SHA-1 (legacy - not for security)

—

A fingerprint for anything

A hash turns any input into a fixed-length fingerprint: change one byte and the output changes completely, but the same input always produces the same hash. That makes it the workhorse behind integrity checks, content addressing, caching keys, and de-duplication. The one thing it is not for is passwords — plain hashes are too fast, so credentials need a slow, salted algorithm like Argon2 or bcrypt on your server.

Related free tools

Epoch / timestamp converterUnix timestamp both ways UUID generatorRandom v4 UUIDs

All free tools →

Free tools for the backend you run.

One of a set of free developer tools from Infraveil — the control plane for running, securing, and watching your backend on servers you own. Browse the rest, no signup.

See all free tools

Get the backend toolkit

Practical tools and guides for shipping and running a backend you own. No spam.