What the result contains
What This Tool Provides
Produce a SHA-1, SHA-256, SHA-384, or SHA-512 digest of any text using the browser’s own Web Crypto implementation, in hex or Base64. Paste a checksum you were given and the tool tells you whether it matches. The text is hashed as UTF-8 bytes, which is what sha256sum and every standard library do, so the digests agree.
- A digest from the browser’s native SubtleCrypto implementation
- Hex or Base64 output, whichever the destination expects
- The digest length in bits, so a truncated paste is obvious
- A match or no-match verdict against a checksum you paste in
How to Use This Tool
- Paste the textType or paste whatever needs hashing. The digest updates as you type.
- Choose the algorithmSHA-256 is the sensible default. Each option explains what it is still good for.
- Compare or copyPaste a published checksum to get a match verdict, or copy the digest for wherever it is going.
How It Works
The text is encoded to UTF-8 bytes and passed to crypto.subtle.digest, the hashing primitive built into the browser. That function is the same implementation used by the platform for TLS and Subresource Integrity, so the result matches what a command-line tool produces for identical bytes. A hash is one-way by construction: the digest is a fixed-length fingerprint of the input, and nothing in it can be run backwards to recover the text. Identical input always produces an identical digest, which is what makes hashes useful for detecting change.
Worked Examples
The standard SHA-256 test vector
- Input
abc- Output
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
This is the worked example published in NIST FIPS 180-4, so it is a quick way to confirm any implementation, including this one.
One character changes everything
- Input
abd- Output
a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9
A single letter changes roughly half the output bits. That avalanche is why a digest detects tampering that a length check would miss.
The empty string still has a digest
- Input
(nothing)- Output
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Hashing zero bytes is well defined. Seeing this specific value usually means an input never arrived rather than that a file was empty.
What a Hash Is Good For, and What It Is Not
A digest answers one question well: are these two inputs byte-for-byte identical? That covers verifying a download against a published checksum, spotting a changed configuration file, deduplicating content, and building an integrity check into a deployment.
It does not make data secret. Hashing is not encryption — there is no key and no way back, but there is also nothing stopping an attacker from hashing likely inputs and comparing. Hashing an email address or a phone number does not anonymise it, because the space of possible values is small enough to enumerate. And a plain SHA-256 of a password is not password storage: purpose-built functions such as bcrypt, scrypt, and Argon2 exist precisely because they are deliberately slow and salted, while SHA-256 is designed to be fast.
Which Algorithm to Use
| Algorithm | Digest size | Reasonable use today |
|---|---|---|
| SHA-256 | 256 bits | The default for checksums, signatures, and content addressing |
| SHA-1 | 160 bits | Legacy checksums and Git object ids only — collisions have been demonstrated since 2017 |
| SHA-384 | 384 bits | TLS cipher suites and some signing profiles that specify it |
| SHA-512 | 512 bits | Wider margin, and often faster than SHA-256 on 64-bit hardware |
Why MD5 Is Not Here
The Web Crypto API does not implement MD5, in any browser, deliberately. This tool could ship a hand-written MD5 to fill the gap, but that would mean maintaining cryptographic code by hand for an algorithm that has been broken since 2004 and should not be chosen for anything new. If you need MD5 to check an old vendor checksum, <code>md5sum</code> on the command line or <code>certutil -hashfile</code> on Windows will give it to you. Everything this page produces comes from the browser’s own audited implementation instead.
The Text Around the Hash
Digests rarely stand alone. When a checksum arrives as Base64 rather than hex — Subresource Integrity attributes and many package manifests use Base64 — converting the encoding is what makes two values comparable in the first place; you can also switch this tool’s own output between the two. If the value you are hashing lives inside a payload, formatting the JSON first makes it obvious which field you actually copied, whitespace included.
Hashes and identifiers get confused often, so it is worth being deliberate: a UUID names a record and carries no information about its contents, while a digest is derived from the contents and changes whenever they do. For values that must resist guessing rather than detect change, generate a password. And when a fingerprint turns up as a <code>kid</code> or thumbprint claim inside a token, decoding the token shows which key it points at — though, as that page says, decoding still proves nothing about the signature. When two digests differ and you need to know why, diffing the two inputs line by line finds the byte that changed, which is usually a trailing newline.
Important Edge Cases
- A trailing newline changes the digest completely, which is the usual reason a copied checksum does not match.
- Hashing the text of a file is not the same as hashing the file: sha256sum reads raw bytes, including line endings and any byte-order mark.
- Windows CRLF and Unix LF line endings produce different digests for text that looks identical on screen.
- SubtleCrypto exists only in a secure context, so the tool cannot run over plain http on a remote host.
- Base64 output is case-sensitive and includes padding; hex output is case-insensitive when compared.
Limitations
- MD5 is not offered because no browser implements it in Web Crypto.
- Text only: this page hashes what you type or paste, not a file you select.
- A digest cannot be reversed here or anywhere else, so there is no lookup of what produced a hash.
- A matching digest proves the bytes are identical, not that the source was trustworthy — a tampered file with a tampered checksum matches perfectly.
- Input above 5,000,000 characters is refused to keep the page responsive.
Input handling
Private Browser Processing
The text is hashed on your device by the browser’s built-in cryptography. Neither the input nor the digest is sent to Tiny Tiny Tools, and neither appears in the page URL.
Google Analytics records page visits and whether a tool finished or failed, but these tool implementations do not send field values, generated passwords, QR payloads, uploaded QR images, or camera frames to analytics or a Tiny Tiny Tools processing endpoint.
Safety note: Hashing does not protect a secret. Avoid pasting live credentials or personal data here, and never treat a hash of an email address or a phone number as anonymised.
See the Privacy Policy for site-wide details.
Questions About This Tool
Why does my digest not match sha256sum?
Almost always a trailing newline. Echoing text on a shell adds one unless you use echo -n, and a file usually ends with one. The bytes differ, so the digests differ.
Can a hash be reversed?
No. A digest is a fixed-length fingerprint and the original text is not recoverable from it. What is possible is guessing: hashing likely inputs and comparing, which is why hashing is not a way to hide small or predictable values.
Should I use this to store passwords?
No. Use bcrypt, scrypt, or Argon2, which are salted and deliberately slow. SHA-256 is fast by design, and that speed is exactly what helps an attacker working through a stolen table.
Is SHA-1 safe to use?
Not for anything security-relevant. Practical collisions were demonstrated in 2017. It remains useful for legacy checksums and for reading Git object ids, which is why it is offered here with that warning attached.
Where is MD5?
The browser’s Web Crypto API does not implement it, and this tool uses only the browser’s own cryptography rather than hand-written code. For a legacy MD5 checksum, use md5sum or certutil locally.