A hash function turns any input — a word, a file, a password — into a short fixed-length string of characters. The same input always gives the same hash, but you can't reverse it back to the original. Here's what that's good for, how the SHA family fits in, and a free tool to hash any text yourself.
Hash any text free →What a hash actually is
A hash is a fingerprint of data. Feed in a million-word book or a single letter and a hash function returns a fixed-length value — SHA-256 always returns 64 hex characters, no matter the input size. It's built to be fast to compute one way and practically impossible to reverse.
Three properties that make it useful
Every good cryptographic hash has three traits:
- Deterministic — the same input always produces the same hash
- One-way — you can't work backwards from the hash to the input
- Collision-resistant — it's infeasible to find two inputs with the same hash
Change a single character of the input and the hash changes completely — this is the avalanche effect, and it's why hashes are good at detecting even tiny tampering.
Hashing is not encryption
This is the point people mix up. Encryption is two-way: with the key you can decrypt it back to the original. Hashing is one-way — there is no key and no “unhash”. So a hash is for verifying data, not for storing something you need to read back later.
The SHA family
SHA (Secure Hash Algorithm) is a family of standard hash functions. SHA-256, SHA-384 and SHA-512 are part of SHA-2 and are the modern default — the number is the output size in bits. SHA-1 is older and considered weak for security use, so treat it as legacy: fine for a non-security checksum, not for anything that must resist attackers.
What hashing is used for
- File integrity — publish a checksum so a download can be verified as unmodified
- Password storage — sites store a hash, not your actual password (with a salt, see below)
- Digital signatures and certificates — the data is hashed, then the hash is signed
- Deduplication and quick comparisons — compare short hashes instead of large files
Why passwords need a salt
Hashing a password plainly isn't enough — attackers precompute hashes of common passwords (rainbow tables) and match them instantly. A salt is a unique random value added to each password before hashing, so identical passwords get different hashes and precomputed tables are useless. Real password systems also use a slow, purpose-built function like bcrypt or Argon2 rather than a plain fast SHA.
Frequently asked questions
Can a hash be reversed?+
No — hashing is one-way by design. You can only confirm a guess by hashing it and comparing. So-called “hash decrypters” are just databases of precomputed hashes for common inputs, not actual reversal.
Which SHA should I use?+
For anything security-related, use SHA-256 or stronger (SHA-384/512). Avoid SHA-1 except for non-security checksums, and never rely on it where an attacker could try to forge a match.
Is it safe to hash text on a website?+
Hashing itself is safe, but never paste real secrets or passwords into any online tool. Our generator runs in your browser, but the safe habit is to hash only non-sensitive text or test data.