SHA Hash fips 180
Compute SHA-1, SHA-256, SHA-384, and SHA-512 digests for the same input at once, in the browser.
What this tool does
SHA is a family of hash functions standardised by NIST. This tool covers SHA-1 (160 bits), SHA-256, SHA-384, and SHA-512, computing several digests from a single input so they can be compared side by side.
SHA-1 produces 40 hexadecimal characters but is no longer recommended for security purposes after a practical collision was demonstrated in 2017. It remains common in developer tooling because Git relied on it for a long time. SHA-256 produces 64 hexadecimal characters and is the current default across TLS certificates, blockchains, file integrity checks, and API request signing. SHA-384 and SHA-512 produce longer digests, and on 64-bit hardware SHA-512 can even be faster than SHA-256.
Digests are computed with the crypto-js library inside your browser, so the input is never transmitted.
When to use it
Use it to compare a downloaded archive against a published checksum, to reproduce an API request signature while debugging, to fingerprint data so changes can be detected, or to confirm that a hash value quoted in documentation is correct.
Input and output examples
hello
SHA-1: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
SHA-1 output is always 40 hexadecimal characters.
hello
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
The same input yields a completely different value and length under a different algorithm.
Notes and limitations
SHA functions are designed to be fast, which makes them a poor choice for password storage because attackers benefit from that speed too; use bcrypt, scrypt, or Argon2 instead. For message authentication use HMAC, which combines the hash with a secret key. Prefer SHA-256 or stronger over SHA-1 in new systems. A single differing space or line ending changes the digest completely, so when a checksum does not match, compare the exact input first.
Frequently asked questions
Should I use SHA-256 or SHA-512?
SHA-256 is sufficient for most purposes and has the widest compatibility. Consider SHA-512 when a longer digest is required or on 64-bit systems where throughput matters.
My checksum does not match the published one.
The download may be incomplete or a different build. Text files also differ by line ending style, where CRLF and LF produce different digests.
Can I hash passwords with SHA?
It is not recommended. SHA is fast by design, which favours brute-force attacks. Use a password-specific function such as bcrypt, scrypt, or Argon2.