Cryptography

Hash Calculator

Calculate SHA hashes from text or uploaded files, compare algorithms, and inspect brute-force resistance metrics for text input.

About hash functions, checksums, and common questions

What is a hash function?

Overview

A hash function converts input data into a fixed-length digest. The input can be text, a file, or another sequence of bytes, and even a small change in the input should produce a very different-looking result.

Hash digests are commonly used for comparison, fingerprinting, integrity checks, deduplication, and verifying that data has not changed. A hash is not an encrypted version of the input and cannot normally be decoded back into the original value.

Where it is used

  • Checking whether a downloaded file matches an expected checksum
  • Comparing text or files without manually reviewing the full content
  • Detecting accidental changes in files, payloads, logs, or documents
  • Generating fingerprints for data, files, messages, and configuration values
  • Verifying API payloads, backups, releases, and build artifacts
  • Learning how SHA-1, SHA-256, SHA-384, and SHA-512 produce different digest formats
  • Estimating how resistant simple text input may be to brute-force guessing

Key facts

  • A hash function is one-way for normal practical use.
  • The same input with the same algorithm should produce the same digest.
  • A tiny input change should produce a very different digest.
  • SHA-256, SHA-384, and SHA-512 are part of the SHA-2 family.
  • SHA-1 is older and should not be chosen for new security-sensitive designs.
  • Hex and Base64 are output encodings for the digest bytes.
  • Hashing is not encryption because there is no decryption key.
  • A brute-force resistance estimate is about guessing the input, not decoding the hash.

Examples

SHA-256 text hash

The text value "hello" always produces the same SHA-256 hex digest when encoded the same way.

Inputhello
Output2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Small input change

Changing even one character should produce a very different hash result. This is useful for detecting modifications.

Inputhello!
OUTPUT (A completely different digest from "hello")ce06092fb948d9ffac7d1a376e404b26b7575bcc11ee05a4615fef4fec3a308b

File integrity check

If a file changes, the calculated hash should also change. This makes hashes useful for download verification and integrity checks.

ScenarioUploaded file bytes
ResultA digest that identifies the exact file content

Hex vs Base64 output

Hex and Base64 can represent the same underlying digest bytes. The algorithm decides the digest; the output format decides how it is displayed.

ScenarioSame digest bytes
ResultDifferent text representations

Brute-force resistance estimate

Resistance metrics can help explain how hard a value may be to guess by trial and error, but they do not account for dictionary attacks, leaked values, or human patterns.

ScenarioShort text input
ResultEstimated guessing resistance

Common mistakes

  • Thinking a hash can be decoded back into the original input.
  • Using SHA hashes alone as password storage without password-specific hashing, salting, and security controls.
  • Choosing SHA-1 for new security-sensitive workflows.
  • Comparing hashes from different algorithms and expecting them to match.
  • Comparing Hex output with Base64 output without realizing they are different encodings.
  • Assuming a hash proves who created a file or message.
  • Treating brute-force estimates as exact security guarantees.
  • Ignoring dictionary attacks, reused passwords, leaked values, and predictable human-created text.

Limitations

  • A hash digest can show that content changed, but it does not explain what changed.
  • Hashing does not provide confidentiality. Anyone with the input can calculate the same digest.
  • A plain hash does not prove authenticity unless it is part of a trusted signing or message authentication process.
  • Brute-force resistance metrics are estimates and depend on assumptions about guessing speed, input randomness, and attack method.
  • Simple hashes are not suitable by themselves for password storage.
  • Large files may take longer to process depending on file size, device performance, browser behavior, and selected algorithm.

Technical details

Hashing vs encryption

Encryption is designed to be reversible with the correct key. Hashing is designed to produce a one-way digest.

This means a SHA digest should be treated as a fingerprint of the input, not as protected or encrypted content.

Hex vs Base64 output

Hex represents digest bytes using characters 0-9 and a-f. It is longer but very common for checksums and developer tools.

Base64 represents bytes more compactly using a larger character set. It is useful when a shorter text representation is preferred.

SHA-1 vs SHA-2

SHA-1 is an older algorithm and is generally not recommended for new security-sensitive usage.

SHA-256, SHA-384, and SHA-512 are SHA-2 algorithms and are more appropriate for modern integrity and fingerprinting workflows.

Checksums and integrity

A checksum or hash can help confirm that content matches an expected value.

For example, if a downloaded file has the same SHA-256 digest as the value published by a trusted source, that is evidence the file bytes match.

Brute-force estimates

A brute-force estimate describes how long it may take to guess an input by trying many candidates.

It is not hash decoding. Hashes are not decoded; attackers attempt guesses, hash each guess, and compare the result.

Frequently asked questions

Can a hash be decoded?

No. A hash is not designed to be decoded. To crack a hash, an attacker must guess possible inputs, hash each guess, and look for a match. This process is called a brute-force attack.

Can I brute-force a hash?

On this page, you can run a short benchmark on your own machine to estimate how long brute-forcing the current text input might take. Treat the result as an approximation, not a guarantee, because real attacks may use dictionaries, leaked passwords, patterns, or faster hardware.

A hash cannot be decoded directly, but it can sometimes be attacked by brute force. That means trying many possible input values, hashing each one, and checking whether the result matches.

How does the brute-force benchmark work?

The benchmark runs a short hashing test in your browser to estimate how many hash attempts your current device can perform per second.

It then compares that speed with the estimated number of possible input combinations for the current text value and shows an approximate brute-force time. This does not decode the hash; it only estimates how long repeated guessing might take under similar conditions.

Is hashing the same as encryption?

No. Encryption is reversible with a key. Hashing is one-way and produces a digest that is used for comparison, fingerprinting, or integrity checks.

Which SHA algorithm should I choose?

SHA-256 is a common default for modern integrity checks. SHA-384 and SHA-512 produce longer digests. SHA-1 is older and should generally be avoided for new security-sensitive workflows.

What is the difference between Hex and Base64 output?

Hex and Base64 are different ways to display the same kind of digest bytes as text. Hex is common for checksums, while Base64 is more compact.

Why do two different files have different hashes?

Hash functions are designed so that even a small change in the input should produce a different digest. This helps detect modified or corrupted files.

Can two different inputs have the same hash?

In theory, yes. That is called a collision. Strong hash algorithms are designed to make useful collisions extremely difficult to find.

Can I use a SHA hash to store passwords?

A plain SHA hash is not enough for safe password storage. Password storage should use password-specific hashing with proper salts and work factors.

What does the brute-force resistance estimate mean?

It estimates how difficult a text value may be to guess by repeated attempts. It does not account for dictionary attacks, leaked passwords, personal information, or natural language patterns.

Does hashing a file upload the file?

For this tool, the page guide states that file digests are calculated from the file bytes in the browser. The digest represents the file content, not the file name.

Private by design

Your input is processed locally in this browser and is not uploaded to MevoLab.

No text input

Input Text

No text input

Digest

Hash Results

hex
Enter text or upload a file to calculate a hash.

Hashes are one-way digests. They are useful for checksums, fingerprinting, comparison, and integrity checks, but they are not encrypted values that can be decrypted later.

Security & IDs Password Generator Security & IDs UUID Generator Data & Encoding Base64 Encoder / Decoder Data & Encoding JSON Formatter Security & IDs JWT Validator Files & Media File Metadata Reader & Editor

Guide

How to use the Hash Calculator

Use this tool to generate one-way hash digests from text or files and compare output across supported SHA algorithms.

Hash text input

Type or paste text into the input area. The calculator generates the selected hash digest and updates the text-resistance estimator.

Hash uploaded files

Switch to file mode and choose a document or binary file. The digest is calculated from the file bytes in your browser.

Choose an algorithm

Generate SHA-256 for common integrity checks, or select all algorithms when you need to compare digest formats.

Understand resistance metrics

The estimator describes brute-force resistance for text input. It does not account for dictionary attacks, leaked passwords, or natural language patterns.

Benchmark your machine

Run the browser benchmark to estimate how quickly this device can compute supported hash types. The result is used to show an approximate crack time on your own machine.