What Is a Cryptographic Hash?
A cryptographic hash function takes an input of any size and produces a fixed-length string of characters called a hash or digest. The same input always produces the same hash, but even a tiny change in input produces a completely different hash. Hash functions are one-way — you cannot reverse a hash to recover the original input.
For example, SHA-256("hello") always produces 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, regardless of when or where you compute it.
Supported Algorithms
- SHA-256 — Produces a 256-bit (64 hex character) hash. The most widely used hash algorithm today, employed in Bitcoin, TLS certificates, and file integrity checks.
- SHA-384 — Produces a 384-bit (96 hex character) hash. Part of the SHA-2 family with a larger internal state, offering additional security margin.
- SHA-512 — Produces a 512-bit (128 hex character) hash. Faster on 64-bit processors and commonly used for password hashing with salt (bcrypt/scrypt alternatives).
All three algorithms are computed using the browser's native Web Crypto API (crypto.subtle.digest), the same technology used for HTTPS and secure web applications.
Common Use Cases
File integrity verification: Compare the hash of a downloaded file against the publisher's published hash to detect corruption or tampering.
API authentication: Many APIs use HMAC-SHA256 signatures. Understanding hash output helps debug signature mismatches.
Password storage (educational): Learn how hashing works — real password storage should use dedicated algorithms like bcrypt or Argon2, not raw SHA-256 alone.
Blockchain and Git: Bitcoin uses SHA-256; Git uses SHA-1 (being phased out). Hashes uniquely identify commits and blocks.
Frequently Asked Questions
Can I reverse a hash to get the original text?
No. Hash functions are designed to be one-way. The only way to find the input for a given hash is brute-force guessing, which is impractical for strong inputs.
Is my input sent to a server?
No. Hashing is performed entirely in your browser using the Web Crypto API. Your text never leaves your device.
Why don't you support MD5?
MD5 has known collision vulnerabilities and is considered cryptographically broken. We support only SHA-2 family algorithms, which remain secure for current applications.
Should I use this to hash passwords?
For learning purposes, yes. For actual password storage, use dedicated password hashing functions (bcrypt, scrypt, Argon2) with salt — not plain SHA-256.