Text Hash Generator
Generate fixed-length hash values using one-way encryption.
-
-
-
Hash One-way Encryption
Cannot recover original - Same input → Same output
- Fixed-length output regardless of input size
- Tiny changes produce completely different results
- Cannot reverse-engineer original from hash
Use Cases
Password storage, file integrity verification, data deduplication, digital signaturesBase64 Two-way Encoding
Can recover original - Encode ↔ Decode
- Output size proportional to input size
- Not encryption, just format conversion
- Anyone can decode to see original
Use Cases
Image to text conversion, URL-safe strings, email attachment encodingPractical Example
Create a SHA-256 hash for a short config value, token sample, or release note string and compare it with a previous value. Even whitespace and line-ending changes produce different hashes, so paste the exact text you want to verify.
What is Text Hashing?
Text hashing converts a string input into a fixed-length hash value using a one-way cryptographic function. Identical inputs always produce identical hashes, but recovering the original text from a hash is computationally infeasible. This property makes hashing essential for password storage, data integrity verification, duplicate detection, and digital signatures.
This tool calculates SHA-256, MD5, and SHA-1 hashes in real-time as you type. All processing uses the browser's Web Crypto API and JavaScript — no data is sent to any server.
Hash vs Base64
Hash (one-way) produces fixed-length output regardless of input size. The original cannot be recovered. Used for security, verification, and integrity checks.
Base64 (two-way) produces output proportional to input size. Anyone can decode it. Used for data transport, not security. See the Base64 encoder for encoding tasks.
Algorithm Comparison
SHA-256 produces a 256-bit (64-character) hash. No collision attacks found — recommended for all modern use cases.
MD5 produces a 128-bit (32-character) hash. Fast but collision-vulnerable since 2004. Use only for legacy compatibility.
SHA-1 produces a 160-bit (40-character) hash. Collision demonstrated in 2017. Avoid in new projects.
Practical Use Cases
Password Storage — Store password hashes instead of plaintext, comparing hashes at login. In production, use dedicated algorithms like bcrypt, scrypt, or Argon2 that add salt and configurable iteration counts.
Data Integrity — Verify that API responses or config files haven't been modified by comparing their hash values.
Duplicate Detection — Quickly identify identical text content in large datasets by comparing hashes instead of full string comparisons.
SRI (Subresource Integrity) — Specify hash values in HTML integrity attributes to prevent execution of tampered CDN scripts.
Important Notes
Encoding sensitivity — The same text encoded as UTF-8 vs UTF-16 produces different hashes. This tool uses UTF-8.
Whitespace sensitivity — Trailing spaces, line endings (LF vs CRLF), and invisible characters change the hash. Normalize input before comparing.
Not for password storage — SHA-256/MD5 are general-purpose fast hashes. For passwords, use bcrypt, scrypt, or Argon2 which add salt and intentional slowness to resist brute-force attacks.
Same Text, Different Hash — Why?
Hashes are computed over bytes, not over what you see on screen. Two visually identical texts hash differently if their bytes differ. Four causes account for nearly all real cases:
| Cause | Example | How to check |
|---|---|---|
| Line endings | Windows CRLF vs Unix LF | Editor's line-ending indicator |
| Trailing whitespace | One newline at end of file | Compare byte counts with a character counter |
| Encoding | UTF-8 vs legacy encodings, BOM presence | File save-encoding setting |
| Unicode normalization | NFC vs NFD (macOS file names) | Invisible — normalize before comparing |
When a hash does not match expectations, check these four before doubting the content itself.
Why Passwords Don't Belong Here
Even though SHA-256 is cryptographically sound, it is too fast for password storage — GPUs compute billions of hashes per second, making brute force practical. Passwords call for deliberately slow functions: bcrypt, scrypt, or Argon2. This tool is for data fingerprinting, deduplication and integrity checks; everything runs in your browser, but the use-case distinction still matters.
FAQ
Can I recover the original text from a hash?
Generally no. Hash functions are one-way. However, short or simple strings can be found via rainbow tables or brute force, which is why passwords need sufficient length and complexity.
What is the difference between hashing and Base64?
Hashing is one-way with fixed-length output — used for security and verification. Base64 is two-way encoding with proportional output — used for data transport. They serve completely different purposes.
Why are MD5 and SHA-1 still provided?
For legacy system compatibility. MD5 has been collision-vulnerable since 2004, SHA-1 since 2017. Always use SHA-256 for new projects.
Can identical text produce different hashes?
Yes, if invisible differences exist: trailing whitespace, line endings (LF vs CRLF), or encoding differences (UTF-8 vs UTF-16). Normalize input before comparing.
Is my input text sent to a server?
No. All hash calculations run in your browser using the Web Crypto API. No network requests are made — verify in the DevTools Network tab.
What is the difference between file hash and text hash?
File hash processes raw file bytes. Text hash encodes a string to UTF-8 first, then hashes the bytes. Results match for identical content, but BOM or line ending differences can cause mismatches. Use the File Hash tool for file verification.