Hash Generator (SHA-1, SHA-256, SHA-384, SHA-512)

What hashing is and what it isn't

A cryptographic hash function takes input of any size and produces a fixed-size output (the 'digest'). Same input always gives the same digest. Tiny input change produces a wildly different digest (avalanche). Reversing the digest to find the input is computationally infeasible for cryptographically strong functions like SHA-256.

Hashing is not encryption. There's no key, no decryption. Common confusions: hashing passwords (use bcrypt/argon2 instead — they slow down brute force), hashing arbitrary text and then 'decoding' it (impossible by design).

Which algorithm to pick

SHA-256 is the modern default. Used in Bitcoin, TLS certificates, JWT signatures (HS256), file integrity hashes. 256 bits is plenty for any realistic security need.

SHA-384 and SHA-512 are larger variants of the same family. SHA-512 is sometimes faster on 64-bit hardware. Use them when a protocol or standard explicitly requires.

SHA-1 is deprecated for security but still appears in legacy systems (older TLS, git commit hashes). Don't use it for new security-critical work — collisions have been demonstrated since 2017. We include it for backward compatibility.

Common uses

File integrity: download a file and a hash; recompute the hash locally; compare. If they match, the file wasn't altered in transit.

Git commits: each commit's identifier is a SHA-1 hash of its contents. Hashing a commit message reveals nothing on its own — you need the rest of the commit to reproduce it.

API request signing: HMAC-SHA-256 is the standard for AWS, GitHub, and many APIs. The hash itself is just one part of HMAC; the API will provide the exact construction it expects.

Caching keys: hashing a URL or set of params gives a stable, fixed-length cache key.