Hash Avalanche

Enter up to 256 UTF-8 bytes and choose Analyze. The tool hashes the original input with SHA-256, then flips each input bit separately and hashes the modified bytes. All input bits are tested: up to 2048 changes. The displayed byte count includes the full text; long input is rejected, never silently shortened.

The input bit index starts at 0 and visits bytes in order. Within each byte, bit 0 is the least significant bit (LSB): the masks are 1, 2, 4, 8, 16, 32, 64 and 128. Each trial starts from the original bytes and changes exactly one bit. The modified byte sequence is hashed directly, even if it is not valid UTF-8. It is never decoded back to text.

Text is encoded using the browser's standard UTF-8 encoding, including replacement of unpaired UTF-16 surrogates. No Unicode normalization is applied. Visually identical text can therefore have different bytes and hashes. The original and modified input are shown completely in hexadecimal, two digits per byte.

SHA-256 produces 256 output bits. XOR of the original and modified hashes has a 1 wherever the hashes differ. Counting these ones gives the Hamming distance. The 16 × 16 mask reads left to right, then top to bottom, most significant bit first within each output byte, matching normal hexadecimal order. Filled squares are 1, outlined squares are 0.

The curve shows every input-bit change; select any trial with the exact index, the slider or the diagram. This selection uses the completed analysis and does not hash again. Mean, minimum and maximum summarize all trials. The 128-bit reference is 50% of the output: a statistical guide, not a required result for one change or proof of cryptographic security.

Empty text is valid and has its own SHA-256 hash. With no input bits, there are no trials or distance statistics. An invalid probe hides its values and mask until corrected. Input changes, clearing the result or leaving the tool cancel pending work. A browser digest already in progress may finish internally, but cannot restore a cancelled result. No partial analysis is presented as complete. SHA-256 must be available through the browser's Web Crypto API. Reloading or changing language retains valid input and waits for a new analysis.

Sources: W3C Web Cryptography API: digest and SHA-256; WHATWG Encoding: TextEncoder and UTF-8. NIST: worked SHA-256 example for abc.