Skip to content
Merlin Tools

SHA hash generator

Compute SHA-1, SHA-256, SHA-384 and SHA-512 of a text, in real time. In the browser, no data sent.

Genuinely free. No sign-up, no email, no limits, no cookies. We don't store the URL you analyse.

Type something: hashes are computed in real time.

SHA-1 is considered weak for security uses (still fine for checksums). For passwords don't use a plain hash: use dedicated functions like bcrypt or Argon2, server-side.

What this tool cannot see

The calculation runs in your browser with Web Crypto: the text never leaves your device. A hash is a one-way fingerprint: it can't be «decoded» back to the original text.

What it's for

A hash is a fixed-length fingerprint computed from data: change a single character and the fingerprint changes completely. It's used to verify the integrity of files and messages, to compare content without revealing it, to generate checksums. It's a one-way operation: you can't get the data back from the hash.

With the other developer tools: the UUID generator, the Base64 converter and the JWT decoder.

Frequently asked questions

Which algorithms does it support?

SHA-1, SHA-256, SHA-384 and SHA-512, computed with Web Crypto, the browser's native cryptographic API. These are the standard algorithms for checksums and data fingerprints.

Why is there no MD5?

Because Web Crypto doesn't include it, and we'd rather not use dubious external polyfills for a cryptographic operation. MD5 is considered obsolete anyway and shouldn't be used for new purposes.

Can I use it for passwords?

No. A plain SHA hash isn't suitable for protecting passwords: that needs purpose-built functions (bcrypt, scrypt, Argon2), with a salt, run server-side. This tool is for checksums and fingerprints, not credential storage.