Data tool
Generate a SHA digest for pasted UTF-8 text. The input stays in your browser and the digest is shown as hex and Base64.
Input
Output
Generate a repeatable fingerprint for a pasted API example, release note, config value, or support snippet. The same UTF-8 text and algorithm produce the same digest; changing even one character changes the result. Compare a digest only when you also trust the expected value and know exactly how the original text was encoded.
Hex and Base64 represent the same digest bytes, so switching the display does not change the hash strength. Hex is common in command-line tools and documentation. Base64 is shorter and useful when a protocol already expects that alphabet. SHA-256 is a sensible general-purpose default; SHA-1 remains here only for compatibility with legacy comparisons.
A hash is one-way, but it is not encryption and does not authenticate who created the text. Plain SHA algorithms are also unsuitable for storing passwords because they are intentionally fast; password systems need a salted, slow password-hashing function. This tool does not hash files, create HMAC signatures, add salts, or compare digests for you.
Hashing uses the browser's Web Crypto API in this tab. The page does not upload or send pasted text to a server. A digest can still reveal that input matches a known value, especially when the source is short or predictable, so treat hashes of sensitive data with care.
Hash UTF-8 text locally and inspect both hex and Base64 forms. Useful for documenting fixtures, comparing short digests, and teaching the difference between encoding and hashing.
For the ASCII string modu, SHA-256 hex is 4de5202b10845b93ab7b3c3782cbe719713d2b60113a0390b78ed73ebbed1de1 (64 hex chars). For 한글, SHA-256 hex is bd87f9bb68b67d2fa1cb82b6751820e946d5b1316d25d5fd96512fb4be44a2a8. Lengths: SHA-1 40, SHA-256 64, SHA-384 96, SHA-512 128 hex characters.
Check trailing newlines (echo vs echo -n), UTF-8 versus legacy encodings, algorithm name, and hex case. Case differences are cosmetic.
Binary installers should be hashed with OS tools, not pasted into a text box. Use this page for short textual samples.
Prefer SHA-256 or stronger for new designs. SHA-1 remains for legacy checksum tables only. Base64 output of a digest is still a digest—not confidentiality. Column widths in databases must match the encoding you store (64 chars for SHA-256 hex, typically 44 for Base64 with padding).
When a download page publishes a SHA-256 hex digest, reproduce it locally before you run the binary. For textual artifacts (license snippets, canonical JSON fixtures) this page is enough: paste the exact bytes as UTF-8 text, select SHA-256, and compare hex. For large binaries prefer shasum -a 256 or certutil so you never load megabytes into a textarea.
Document which algorithm and which encoding (hex versus Base64) your team stores. Mixing them in a runbook is a common source of false mismatch alerts. If two engineers disagree, first compare newline policies and Unicode normalization (NFC versus NFD) on the sample string.
Show newcomers the same string in Base64 mode on the workbench and as SHA-256 here. Base64 length grows linearly and reverses. The hash length stays fixed and does not reverse. That live contrast prevents the “we Base64’d the secret so it is safe” mistake better than a slide deck.
Keep SHA-1 available only to verify legacy checksum tables. New protocols should start at SHA-256 or stronger. Password storage remains out of scope for any single SHA pass without salt and a slow KDF.
| Algorithm | Hex length | Typical Base64 length |
|---|---|---|
| SHA-1 | 40 | 28 |
| SHA-256 | 64 | 44 |
| SHA-384 | 96 | 64 |
| SHA-512 | 128 | 88 |
Size database columns against the encoding you actually store. Storing hex in a 32-character field silently truncates SHA-256. Prefer lowercase hex in logs for greppability, but treat case as insignificant when comparing.
Never paste customer personal data just to “see the hash.” Even local tools get screen-shared. Use synthetic fixtures that look realistic without being real.
SHA-1, SHA-256, SHA-384 and SHA-512 via Web Crypto, shown as hex and Base64.
No. A digest is a fingerprint, not encryption.
No. Use a password hashing scheme with salt (bcrypt, scrypt, Argon2).
No. Still avoid pasting production passwords into any web UI.