Computes a cryptographic hash (MD5, SHA-1, SHA-256, SHA-384, SHA-512) of your text in the browser.
—Computes a cryptographic hash (MD5, SHA-1, SHA-256, SHA-384, SHA-512) of your text in the browser.
hello
sha256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
The same input always produces the same hash.
Equal hashes mean equal inputs (with overwhelming probability for SHA-2).
Your input is processed entirely in your browser and never sent to a YAS server.
curl -X POST "https://yas.sh/api/v1/tools/hash-calculator" \
-H "Content-Type: application/json" \
-d '{"input":"hello","algo":"md5"}'const res = await fetch("https://yas.sh/api/v1/tools/hash-calculator", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
"input": "hello",
"algo": "md5"
}),
});
const data = await res.json();import requests
r = requests.post("https://yas.sh/api/v1/tools/hash-calculator", json={"input":"hello","algo":"md5"})
data = r.json()| Field | Type | Required | Description |
|---|---|---|---|
| input | string | Yes | Text to hash (≤ 64 KB) |
| algo | string | No (default "sha256") | One of md5, sha1, sha256, sha384, sha512 |
{ "slug": "hash-calculator", "algo": "md5", "result": "5d41402abc4b2a76b9719d911017c592" }Cryptographic digest of a string.
400 VALIDATION_ERROR — invalid input or unsupported option.413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).A cryptographic hash compresses input of any length into a fixed-size digest by iterating a compression function over padded message blocks. SHA-256 processes 512-bit blocks into a 256-bit state; SHA-512 uses 1024-bit blocks and 64-bit words. The result is deterministic — the same bytes always produce the same digest — and avalanche behaviour means a single flipped bit changes roughly half the output bits.
The property that makes hashes useful is one-wayness: computing the digest is cheap, recovering the input is not. There is no 'decrypt' operation. What an attacker can do is guess — hash candidate inputs until one matches — which is why hashing a password with SHA-256 is unsafe: a modern GPU computes billions of SHA-256 digests per second.
MD5 and SHA-1 remain in the tool because they are still required to verify legacy artefacts, but both are broken for security purposes. MD5 collisions are trivially constructible, and SHA-1 fell to the SHAttered attack in 2017. Use SHA-256 or better for anything where an adversary benefits from forging a match.
Hash the file's contents and compare with the SHA-256 the vendor published over a different channel. A match proves integrity, not authenticity — if the attacker controls both the file and the page listing the checksum, the comparison proves nothing. Prefer a signed checksum file where one exists.
Hashing a normalised email address gives a stable key you can compare across systems without keeping the address itself. Add a secret salt with the HMAC tool if the value space is small enough to brute-force, which it is for emails and phone numbers.
A digest of the serialized inputs gives a fixed-length, collision-resistant identifier for a computed result. SHA-256 truncated to 16 hex characters is common practice and keeps keys short enough for headers.
Comparing digests avoids transferring the file. Equal digests from a modern algorithm mean the bytes are equal for every practical purpose; differing digests localise the problem to transfer or encoding, often a CRLF conversion.
What this tool deliberately does not do, and where it will disagree with other implementations.