ForHosting KIT · Developer Utilities

Hash a string

Hashing looks like a one-line function call until you need it consistently across a fleet of services, in bulk, with the right algorithm for the right job. This sha256 hash api generates SHA-256, SHA-512, MD5 and bcrypt hashes on request, so integrity checks and password storage don't depend on every service reimplementing the same primitive correctly.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Four algorithms, four different purposes

SHA-256 and SHA-512 are cryptographic hash functions built for integrity verification and digital signatures, fast by design, which is exactly why they're wrong for passwords, a fast hash means an attacker can try billions of guesses per second. MD5 is faster still and considered broken for any security purpose since practical collision attacks were demonstrated in 2004, it survives today only for non-adversarial checksums like verifying a file wasn't corrupted in transit. Bcrypt inverts the whole premise: it's deliberately slow, with a tunable work factor, because slowing down the attacker is the entire design goal when the thing being protected is a password.

What POST /dev/hash does

You send the input string and the desired algorithm. For SHA-256, SHA-512 and MD5, you get back the digest in hexadecimal. For bcrypt, you get a salted hash with the work factor embedded in the output, ready to store as-is, since bcrypt's format already carries everything needed to verify a match later without you tracking the salt separately.

Where SHA-256 in particular shows up

Published by the National Security Agency in 2001 as part of the SHA-2 family, SHA-256 became the backbone of an enormous amount of infrastructure that came after it, package managers verifying download integrity, git's move toward SHA-256 object storage, and countless systems that need a fixed-length fingerprint of arbitrary data. Its popularity isn't accidental, it strikes a practical balance between security margin and computational cost that has held up for over two decades.

How it fits an automated pipeline

Deduplication systems that fingerprint files before storing them, build systems that verify artifact integrity before deployment, and signup flows that need to hash a password before it ever touches a database all call this endpoint the same way: submit, get a task_id back, and receive the result through a signed webhook or a signed link valid for 24 hours. Bulk requests, hashing a large batch of records during a migration, run the same way without a special code path.

Picking the right one

If you're protecting a password, bcrypt, no exceptions. If you're verifying data integrity or generating a fingerprint, SHA-256 is the sound default and SHA-512 is available when a longer digest is worth the extra bytes. MD5 exists here for compatibility with legacy systems that still expect it, not as a recommendation for anything security-sensitive.

What you can do with it

Password hashing for signup flows

Hash a new user's password with bcrypt before it's written to the database, with the work factor and salt already embedded in the output.

File integrity verification

Generate a SHA-256 digest for uploaded files so downstream systems can confirm the file wasn't altered before processing it.

Bulk deduplication

Hash a large batch of records in one call to identify duplicates by comparing digests instead of full field-by-field content.

Legacy checksum compatibility

Produce an MD5 checksum for integration with an older system that still expects that specific format for non-security file verification.

FAQ

Which algorithms does this sha256 hash api support?

SHA-256, SHA-512, MD5 and bcrypt, each returned in the format appropriate to how that algorithm is normally used.

Should I use SHA-256 to hash passwords?

No. SHA-256 is fast by design, which makes it unsuitable for passwords; use bcrypt instead, since its deliberate slowness is what protects against brute-force attacks.

Is MD5 still safe to use?

Not for any security purpose, practical collision attacks have been demonstrated since 2004. It's included here for compatibility with legacy checksum needs, not as a security recommendation.

Can I hash data in bulk?

Yes, since tasks run asynchronously, you can submit large batches for hashing without blocking your application while results are generated.

Is there a free tier?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

How much does each request cost?

$0.002 per request, charged only for tasks that complete successfully.

How do I get the hash back?

POST /dev/hash returns a task_id immediately, and the result is delivered via signed webhook or a signed link valid for 24 hours.

Does bcrypt output include the salt?

Yes, bcrypt's format embeds the salt and work factor directly in the output string, so nothing extra needs to be stored separately to verify it later.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/hash

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/hash \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/dev/hash", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/hash",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/hash", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/hash", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.hash",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free