Hash Generator

About Hash Generator

Cryptographic hashes turn any input into a fixed-length fingerprint. This runs entirely in your browser through the Web Crypto API, which matters because the strings people hash - config fragments, tokens, passwords - are exactly the strings that should never be posted to a website.

Comparing digests safely

When a hash or MAC is compared to decide access, use a constant-time comparison — crypto.timingSafeEqual, hmac.compare_digest, hash_equals. A normal string comparison returns as soon as it finds a differing byte, and that timing difference is enough to recover the expected value one byte at a time over many requests. It costs nothing to do correctly, and the failure is invisible in testing.

Which algorithm to use

SHA-256 is the sensible default for integrity and fingerprinting. SHA-512 is faster on 64-bit hardware and no less secure. SHA-1 should be treated as broken - a practical collision was demonstrated in 2017. None of these are appropriate for storing passwords: a fast hash is exactly wrong for that, which is why bcrypt, scrypt and Argon2 exist.

Common use cases

• Verifying a downloaded file matches a published checksum.
• Fingerprinting a configuration blob to detect drift.
• Producing a digest for an API signature during development.

Edge cases and gotchas

• Never store passwords with a plain hash, salted or not - use bcrypt, scrypt or Argon2.
• Hashes are computed over UTF-8 bytes; a trailing newline changes the result, which is the usual cause of a checksum mismatch.