Generate a text hash
Type “Hello, world!”, choose SHA-256 and get a 64-character fingerprint of exactly that text. Every space, capital letter and line break counts, so two values only match when the text and the algorithm are identical. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Generate a hexadecimal hash from any text with a clear choice of MD5, SHA-1, SHA-256, SHA-512, or CRC32. The tool treats the text exactly as entered, encodes it as UTF-8, and returns a lowercase hexadecimal value. Every supported algorithm is deterministic: the same characters, spacing, capitalization, and algorithm always produce the same result.
Choose an algorithm that matches your purpose
A hash algorithm converts text of any length into a fixed-format value, but the available algorithms are not interchangeable. SHA-512 produces a longer digest and is useful when a protocol or existing integration explicitly specifies it. MD5 and SHA-1 remain common in older APIs, manifests, checksums, and migration work, so this generator supports them for compatibility; however, neither should be selected for new security-sensitive designs because practical collision attacks exist.
CRC32 is a compact error-detection checksum rather than a cryptographic hash. It is suitable for matching archive metadata, legacy file formats, network fields, or quick accidental-corruption checks. It is not suitable for passwords, signatures, authentication, or adversarial tamper detection.
When reproducing a value from documentation or another application, choose the exact algorithm named by that source rather than assuming that digest length alone expresses the intended security properties.
Enter text precisely and interpret the result
The input is encoded as UTF-8 before hashing, and the result is returned as lowercase hexadecimal. Every character matters. A trailing space, a newline copied from a terminal, different capitalization, or a visually similar Unicode character changes the output completely.
If your result does not match a reference value, first check whether the other system includes line endings, a byte-order mark, surrounding quotes, or a final newline. The response includes both the digest and the normalized algorithm name, which makes recorded results easier to audit. Hexadecimal output uses two characters per digest byte, so MD5 has 32 characters, SHA-1 has 40, SHA-256 has 64, SHA-512 has 128, and CRC32 has 8.
Use hashes safely in automation
Store the algorithm beside the value because an unlabeled digest can become ambiguous when a system is upgraded. Compare hashes only when both sides use the same input encoding and byte sequence. Do not use this tool as a password hasher: fast algorithms let attackers test guesses rapidly, while password storage requires a dedicated, salted, deliberately expensive construction such as Argon2, scrypt, bcrypt, or PBKDF2 with appropriate parameters.
Likewise, a plain hash does not prove who created a message. Use an HMAC with a secret key for message authentication or a digital signature when identity and tamper resistance matter. Finally, remember that hashing is one-way transformation, not encryption.
It cannot restore the original text, and hashing a predictable secret does not make that secret safe from guessing.
What you can do with it
Check legacy checksums
Match MD5, SHA-1, or CRC32 values used by older manifests and formats while keeping their compatibility role distinct from modern security.
FAQ
Is the hexadecimal output uppercase or lowercase?
The output is lowercase hexadecimal with leading zeroes preserved to the full length required by the selected algorithm.
Can I hash an empty string?
Yes. An empty string is valid text and has a well-defined digest for every supported algorithm.
Why does my hash differ from another tool?
Check the algorithm, UTF-8 encoding, capitalization, spaces, line endings, final newline, and whether the other tool hashes decoded bytes instead of literal text.
Can I use this for passwords?
No. Use a salted password-hashing function such as Argon2, scrypt, bcrypt, or PBKDF2 with parameters chosen for your environment.
Is CRC32 a cryptographic hash?
No. CRC32 detects many accidental data changes but is not designed to resist deliberate collisions or tampering.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/web/hash-generate \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Hello, world!","algorithm":"sha256"}'const res = await fetch("https://api.kit.forhosting.com/web/hash-generate", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Hello, world!",
"algorithm": "sha256"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/web/hash-generate",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Hello, world!",
"algorithm": "sha256"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/web/hash-generate", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Hello, world!","algorithm":"sha256"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Hello, world!","algorithm":"sha256"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/web/hash-generate", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Hello, world!",
"algorithm": "sha256"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "web.hash_generate",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
timeout_sec | 30 |
max_crawl_pages | 25 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Enter text precisely and interpret the result
Also confirm whether it hashes the raw text or a decoded representation such as JSON, Base64, or hexadecimal bytes. This capability always hashes the UTF-8 bytes of the literal text field; it does not silently trim, normalize, decode, or change that text.
Use hashes safely in automation
For automated calls, the base price is $0.002 per item, and the response is stable for identical input.
Integration use cases
Reproduce an integration digest
Hash an exact sample payload with the algorithm specified by a partner API and compare the hexadecimal output during debugging.
Create stable test fixtures
Generate deterministic expected values for unit tests without relying on network access, timestamps, random salts, or changing services.
Technical questions
What does one hash cost?
The API base price is $0.002 per item. The browser version can run locally without an API call.