What a hash is for
A cryptographic hash turns any input into a fixed-size fingerprint: SHA-256 always produces 256 bits, shown as 64 hexadecimal characters. Changing a single character of the input changes the digest completely, and it is infeasible to find two inputs with the same SHA-256 digest. That makes hashes useful for checking downloads, deduplicating files, content addressing and signing.
SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family standardised in FIPS 180-4. SHA-1 is included for legacy checksums only: practical collisions were demonstrated in 2017, so it must not be used for security.
Worked example
The FIPS 180-4 test message abc hashes to ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. The empty string hashes to e3b0c442…7852b855.
Hashes are not for storing passwords on their own; use a slow, salted function such as Argon2 or bcrypt for that.
How this works
The text is encoded as UTF-8 bytes (so é is two bytes) and passed to crypto.subtle.digest — the browser's built-in Web Crypto implementation of FIPS 180-4. The resulting bytes are printed as lowercase hexadecimal. The hash updates as you type and nothing leaves the page.
Frequently asked
Can a SHA-256 hash be reversed?
No. Hashing is one-way. Short or common inputs can be guessed by trying candidates, which is why passwords need salted, slow hashes.
Why does my hash differ from another tool's?
Usually because of invisible differences: a trailing newline, Windows line endings or a different text encoding. This tool hashes exactly the UTF-8 bytes you see.
Is SHA-1 still safe?
Not for security. Collisions are practical; use SHA-256 or stronger.
Is my text sent anywhere?
No. The digest is computed by your browser; nothing is uploaded or logged.
Sources
Reviewed Oct 17, 2026 · test vectors fixtures/dev/sha256-hash/