SHA-256 hash generator
Hash text with SHA-1, SHA-256, SHA-384 or SHA-512, computed locally by the browser's own Web Crypto implementation. To hash a whole file instead, use the file hash verifier.
Runs in your browser — nothing is uploadedWhich algorithm
SHA-256 for anything new. SHA-1 is broken for collision resistance and should only be used to interoperate with something that already requires it, such as Git object ids. MD5 is broken outright and belongs only in legacy checksums. Hash length says nothing about fitness: SHA-512 is not "more secure" than SHA-256 for practical purposes.
Hashing is not password storage
A fast hash is the wrong tool for passwords precisely because it is fast: an attacker can try billions per second. Passwords need a deliberately slow, salted function such as argon2id, scrypt or bcrypt. A salted SHA-256 is still far too fast.
Hash vs HMAC
A hash proves the content has not changed. An HMAC proves it came from someone holding the key. If you are authenticating a webhook, you need the HMAC, and you need to compare it in constant time.
Questions
Which hash should I use?
SHA-256 unless something forces otherwise. SHA-1 and MD5 are both broken for security purposes, though they remain fine as non-adversarial integrity checks.
Can I use SHA-256 for passwords?
No. It is far too fast, so an attacker can brute-force it at enormous rates. Use argon2id, scrypt or bcrypt, which are slow by design.
Is my text sent to a server?
No. The hashing uses the browser's built-in Web Crypto API and happens entirely on your machine.
How do I hash a file rather than text?
Use the file hash and checksum verifier, which reads the file locally and can compare the result against an expected digest.