Hash Generator & Diff Checker

Generate SHA-256 and SHA-1 hashes from text using the browser's native Web Crypto API, and compare two pieces of text to see exactly what changed between them.

What a hash is and why it is useful

A hash is a fixed-length fingerprint of data. Feed in one word or a two-gigabyte file and SHA-256 returns exactly 64 hexadecimal characters. The same input always produces the same hash, on any machine, forever. Change one character and the output changes completely — not slightly, but unrecognisably. That avalanche property is what makes hashes good at detecting tampering: there is no such thing as a close match. Hashing is one-way. You cannot reverse a hash to recover the original, and there is no decryption step. Hashing is not encryption.

Why MD5 and SHA-1 are no longer trusted

Both were once standard and both are now broken for security purposes, because researchers demonstrated practical ways to construct two different files sharing a hash. Once that is possible, a hash no longer proves a file is unmodified. SHA-1 is offered here for compatibility with older systems that still use it, and it remains adequate for detecting accidental corruption. For anything where deliberate tampering is a concern, SHA-256 is the sensible minimum. MD5 is not offered at all — browsers deliberately exclude it from their cryptography API.

What a checksum does and does not prove

Comparing a downloaded file's hash against a published value confirms the file matches what was published. Identical means byte-for-byte the same; different means something changed. But a checksum only proves the file matches the value you compared it against . If an attacker controls the website, they can replace both the file and the published checksum. Checksums therefore protect mainly against accidental corruption and tampering in transit. Protection against a compromised source requires a digital signature, which uses a key the attacker does not hold.

A caution about passwords

Hashes are how well-built systems store passwords, but plain SHA-256 is the wrong tool for it. It is designed to be fast, and speed helps an attacker testing billions of candidates. Password storage uses deliberately slow algorithms such as bcrypt, scrypt or Argon2, plus a random salt per password so identical passwords do not produce identical hashes. Reaching for SHA-256 alone is a well-known mistake if you are ever building a system that stores credentials.

Quick tips

• You need not compare all 64 characters by eye — the first and last six is enough in practice.
• A hash tells you whether something differs; the diff checker tells you what differs.
• Hashing happens locally via the Web Crypto API; your text is never transmitted.
• For security-critical downloads, look for a digital signature rather than only a checksum.

Is SHA-256 safe for checksums?

Yes, SHA-256 is an industry standard cryptographic hash function widely used for integrity checks.