What a cryptographic hash actually is
A cryptographic hash function takes any input — a single character, a paragraph, or a
multi-gigabyte file — and produces a fixed-length string called a digest. The same
input always yields the same digest (it is deterministic), but the function is
one-way: there is no practical way to run it backwards and recover the original
data. It also has the avalanche effect — change one character and roughly half
the output bits flip, so two near-identical inputs produce completely unrelated digests. This
tool computes those digests with crypto.subtle.digest(), the browser’s built-in
Web Crypto API, entirely on your device.
A worked example
Hash the lowercase word hello with SHA-256 and you always get
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Capitalise a
single letter to Hello and the digest becomes
185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 — totally
different, despite a one-character change. Notice the length never varies: SHA-256 always
returns 64 hexadecimal characters, no matter how large the input is.
Choosing an algorithm
| Algorithm | Digest size | Hex length | Status & typical use |
|---|---|---|---|
| SHA-256 | 256 bits | 64 chars | Secure — TLS certificates, blockchains, file checksums. The default choice. |
| SHA-512 | 512 bits | 128 chars | Secure — fast on 64-bit hardware, signatures, key derivation. |
| SHA-384 | 384 bits | 96 chars | Secure — a truncated SHA-512 used in IPsec and government profiles. |
| SHA-1 | 160 bits | 40 chars | Weak — collisions are practical. Fine for Git IDs, not for security. |
Hashes power data-integrity checks (compare a download against its published checksum), content addressing (Git names every object by its hash), digital signatures and deduplication. One thing they are not built for is storing passwords directly: a raw SHA digest is far too fast to compute, so use a deliberately slow, salted function such as bcrypt, scrypt or Argon2 for that job.