Hash any text with SHA-1, SHA-256, SHA-384, and SHA-512 at once. Type below to see all four hex digests update live, then copy any digest - all hashing stays in your browser.
Technical Specifications
Algorithms and encoding rules used for every digest.
| Specification |
Details |
| Algorithms |
SHA-1, SHA-256, SHA-384, SHA-512 - toggle each one independently |
| Digest sizes |
160-bit (40 hex), 256-bit (64 hex), 384-bit (96 hex), 512-bit (128 hex) |
| Engine |
Web Crypto API (crypto.subtle.digest) - native code, no libraries |
| Input encoding |
UTF-8 bytes via TextEncoder, so emoji and non-Latin text hash correctly |
| Output encoding |
Hexadecimal, lowercase by default with an uppercase toggle |
| Live hashing |
Every keystroke recomputes all selected digests; overlapping runs are discarded safely |
| Processing location |
100% client-side JavaScript in your browser memory; nothing is uploaded |
| Export |
Copy any single digest, copy all with labels, or download a plain-text report |
| Usage limit |
None - hash unlimited texts for free, no signup required |
Understanding Cryptographic Hashes
A cryptographic hash maps text of any length to a fixed-size fingerprint. The same input always yields the same digest, while any tiny edit - even one letter - produces a completely unrelated one. That combination makes hashes the standard tool for verifying downloads, signing API payloads, and storing password verifiers.
The SHA-2 family: 256, 384, and 512
SHA-256 is the workhorse: 256 bits of output, fast everywhere, and trusted for certificates, blockchains, and file checksums. SHA-384 and SHA-512 use larger internal states and suit high-assurance signing and long-term archiving. All three remain unbroken after two decades of analysis, so for new work pick SHA-256 by default and reach for SHA-512 when policy demands a larger digest.
Why SHA-1 is legacy-only
SHA-1's 160-bit digests suffer practical collision attacks: researchers have demonstrated two different files with the same SHA-1. Browsers and certificate authorities abandoned it years ago. It remains here for verifying old checksums and Git object IDs - never for signatures, passwords, or integrity promises on new data.
Where hashes get used daily
Software releases publish SHA-256 checksums so you can confirm a download was not corrupted or tampered with - hash the file bytes and compare strings. Developers fingerprint API bodies with HMAC-SHA-256 to prove requests are authentic. And systems never store your password; they store a salted hash and re-hash your login attempt to compare. To audit a password itself rather than hash text, use the Password Strength Checker.
Honest limitations
Hashes cannot be reversed, and this tool cannot hash files directly - paste the text content instead, or use a dedicated file-checksum utility for large binaries. Very long inputs (megabytes of text) still hash correctly but may take a visible moment since the whole string is encoded to UTF-8 first. For the older 128-bit MD5 checksum format, use the MD5 Generator instead.
Privacy and Client-Side Security
Privacy Guarantee: All hashing occurs locally inside your browser. Your text and digests are never transmitted, stored, or recorded on remote servers.
Hashing needs no server: the algorithms are standardized math, and your browser ships native implementations. TinyToolzz calls SubtleCrypto directly in your tab, encodes with TextEncoder, and formats hex with plain JavaScript.
Because nothing is uploaded, there is no waiting, no account, and no copy of your text retained anywhere. Your values exist only in the tab's memory and are discarded when you close the page or click Clear.