Docify

Hash generator

Generate SHA-256, SHA-1, and MD5 hashes for text and files in your browser. Checksum tool using Web Crypto API — nothing uploaded.

Generate cryptographic hashes for text or files directly in your browser.SHA-256 (256-bit, secure) and SHA-1 (160-bit, legacy) use the Web Crypto API (crypto.subtle.digest).MD5 (128-bit, broken) is implemented in JavaScript for legacy checksums only. Text is encoded as UTF-8 before hashing. Files are hashed from their raw bytes. This is a checksum tool — not a password hasher. Use bcrypt or Argon2 for passwords. All processing happens locally.

Text (UTF-8)
Digest

Hash output will appear here as hex...

How it works

  1. Choose input type: Select Text to hash a string, or File to hash a file's raw bytes.
  2. Select algorithm: SHA-256 is recommended for most uses. SHA-1 and MD5 are provided for legacy compatibility but have known vulnerabilities.
  3. Enter or upload content: For text, the string is encoded as UTF-8 before hashing. For files, the raw bytes are hashed directly.
  4. Click Hash: The digest is computed using crypto.subtle.digest (SHA-256/SHA-1) or a JavaScript MD5 implementation.
  5. Copy the result: The hash is displayed as lowercase hexadecimal. Check "Uppercase" for capital letters. Click Copy to copy to clipboard.

Hash algorithm comparison

AlgorithmOutputSecurityUse case
SHA-256256 bits (64 hex)SecureIntegrity, checksums
SHA-1160 bits (40 hex)WeakLegacy systems only
MD5128 bits (32 hex)BrokenLegacy checksums only

Hashing in JavaScript

SHA-256 with Web Crypto

async function sha256(text) {
  const encoder = new TextEncoder();
  const data = encoder.encode(text);
  const hash = await crypto.subtle.digest('SHA-256', data);
  return Array.from(new Uint8Array(hash))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}

await sha256('hello');
// "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

SHA-256 in Python and Node

The snippets below hash UTF-8 bytes and print a 64-character lowercase hex digest, the same SHA-256 output this page shows for text. They are unkeyed message digests, not password hashes. For the security status of each algorithm, see SHA-256 vs SHA-1 vs MD5: Differences and Which to Use.

Node.js with crypto.createHash

Node's crypto.createHash('sha256') uses OpenSSL. Pass 'utf8' to update so the digest matches this page's TextEncoder UTF-8 path:

import { createHash } from 'node:crypto';

const hex = createHash('sha256')
  .update('hello', 'utf8')
  .digest('hex');
// "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"

Python with hashlib

CPython hashlib.sha256 is FIPS 180-4 SHA-256. It accepts bytes only — passing a str raises TypeError. Encode UTF-8 first, the same as this page:

import hashlib

hexdigest = hashlib.sha256('hello'.encode('utf-8')).hexdigest()
# '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824'

hashlib.sha1 / createHash('sha1') and hashlib.md5 / createHash('md5') use the same hex API. Treat those as legacy checksums only — not for security or password storage.

SHA-256 checksum in the shell

File mode on this page hashes the file's raw bytes and prints lowercase hex — the same digest GNU sha256sum and macOS shasum -a 256 compute. Those commands also print a filename column; this page does not. Text mode hashes UTF-8 bytes with no extra newline. echo hello appends a newline, so use printf to match this page's hash of hello. GNU cksum without -a is the POSIX 32-bit CRC, not SHA-256. Coreutils 9.0+ accepts -a sha256 for the same digest; the default line is BSD-tagged (SHA256 (name) = hex), not this page's bare lowercase hex. These are unkeyed checksums, not password hashes.

GNU sha256sum (Linux)

Coreutils sha256sum reads the file and writes hex filename. The first field is the digest this page shows:

# File (same bytes as this page's File mode)
sha256sum report.bin

# Text without a trailing newline (same as this page's Text mode)
printf 'hello' | sha256sum
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  -

macOS shasum

macOS ships shasum, not sha256sum. Pass -a 256:

shasum -a 256 report.bin

printf 'hello' | shasum -a 256
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  -

OpenSSL dgst

openssl dgst -sha256 hashes the same bytes. The digest is the last field; the prefix string varies by OpenSSL version:

openssl dgst -sha256 report.bin

printf 'hello' | openssl dgst -sha256
# ... 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

GNU cksum (Linux)

Coreutils 9.0+ cksum -a sha256 (or --algorithm sha256) hashes the same bytes as sha256sum. Default output is BSD-style tagged (SHA256 (-) = hex). Pass --untagged for the sha256sum layout (hex filename). This page prints only the lowercase hex:

# File (same bytes as this page's File mode)
cksum -a sha256 report.bin
# SHA256 (report.bin) = ...

# Text without a trailing newline (same as this page's Text mode)
printf 'hello' | cksum -a sha256
# SHA256 (-) = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

printf 'hello' | cksum -a sha256 --untagged
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  -

sha1sum / shasum -a 1 and md5sum / macOS md5 follow the same hex layout for SHA-1 and MD5. Treat those as legacy checksums only. cksum -a sha1 and cksum -a md5 hash those same algorithms. Algorithm names are lowercase: sha256, sha1, md5 — SHA256 and SHA-256 fail. Without -a, GNU cksum writes the POSIX CRC (3287646509 5 for hello), not SHA-256. --base64 emits Base64, not this page's hex. --raw emits binary. macOS BSD cksum has no --algorithm; Homebrew coreutils installs gcksum. cksum --check verifies a checksum file; this page does not compare. Empty stdin hashes to the empty SHA-256 (e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855); this page asks for text instead. Windows certutil -hashfile file SHA256 prints uppercase hex with spaces between bytes — strip spaces and lowercase before comparing with this page.

FAQ

What hash algorithms are supported?
SHA-256 (recommended for most uses), SHA-1 (legacy, collision-vulnerable), and MD5 (legacy checksum only). SHA-256 and SHA-1 use the Web Crypto API (crypto.subtle.digest). MD5 is implemented in JavaScript since Web Crypto does not support it.
What is the difference between SHA-256, SHA-1, and MD5?
SHA-256 produces a 256-bit (64 hex character) hash and is secure for integrity checks. SHA-1 produces 160 bits (40 hex) but has known collision attacks — avoid for security purposes. MD5 produces 128 bits (32 hex) and is completely broken for security — use only for legacy checksums.
Is this tool a password hasher?
No. These are unkeyed message digests, not password hashes. For passwords, use bcrypt, Argon2, or scrypt — algorithms designed to be slow and salted. SHA-256/SHA-1/MD5 are too fast and unsalted for secure password storage.
Can I verify a file checksum with this tool?
You can generate a hash to compare manually, but this tool does not have a built-in comparison feature. Generate the hash, then compare it with the expected value yourself.
Does this tool upload my files?
No. All hashing runs entirely in your browser using the Web Crypto API. Your text and files are never sent to a server. The file is read into memory locally using File.arrayBuffer().
Why might SHA-256 fail?
crypto.subtle.digest requires a secure context (HTTPS or localhost). On plain HTTP pages, the Web Crypto API is unavailable and SHA-256/SHA-1 will fail. MD5 uses a JavaScript implementation and works in any context.

Related