Developer · Hashing
SHA-256 hash generator.
Get the SHA-256 hash of text or a file as hex or Base64. It uses your browser's native SubtleCrypto, and nothing leaves the page.
How to use the SHA-256 generator
- Type or paste text into the box, or choose a file to hash instead.
- Press the generate button and wait a moment for large files.
- Copy the value, then compare it with the checksum or signature you were given.
About SHA-256
SHA-256 produces a 256-bit digest, written as 64 hexadecimal characters. SHA-256 is the usual default today. It is part of the SHA-2 family in FIPS 180-4 and is what most software publishers use for download checksums, certificate fingerprints and content-addressed storage.
Your input stays on your device
The calculation runs in your browser inside a sealed frame that cannot make network requests, so the text, file or key you enter is never uploaded. The advertising on this page sits outside the frame and cannot see what you enter.
- Line endings and trailing spaces change the result, so paste exactly what you mean to hash.
- Hashing is one-way: you cannot recover the original input from the digest.
- If a file and text are both provided, the file is hashed.
About SHA-256
SHA-256 belongs to the SHA-2 family in FIPS 180-4. It outputs 256 bits (32 bytes), shown as 64 hexadecimal characters, and is the usual choice for file-integrity checksums, content addressing and signature digests.
Text is hashed as UTF-8 bytes; a file is hashed byte for byte. Even one changed character or an added trailing newline produces a completely different digest. To check a download against a published value, use the File Hash Checker, which does the comparison for you.
Known-answer examples
Use these to confirm the tool matches the standard. The Try button loads the input.
| Input | SHA-256 (hex) | Source | |
|---|---|---|---|
| Empty string | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | zero-length input | |
| abc | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad | FIPS 180-4 / RFC 6234 | |
| abcdbcdecdefdefg… (56 chars) | 248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1 | FIPS 180-4 / RFC 6234 |
The empty-input digests are not among the FIPS 180-4 examples; they are the digests of a zero-length message and match OpenSSL in our test suite.
Sources (retrieved October 2026):
Frequently asked questions
How long is a SHA-256 hash?
Always 256 bits: 32 bytes, 64 hexadecimal characters, or 44 characters in Base64 (with padding), no matter how large the input is.
Is SHA-256 encryption?
No. It is a one-way hash: you cannot recover the input from the output, and there is no key. If you need a keyed hash to prove a message came from someone with a shared secret, use HMAC-SHA256.
Why does my SHA-256 not match the command line?
A trailing newline is the usual cause: echo text | sha256sum hashes the text plus a line feed. Encoding matters too, since this page hashes UTF-8 bytes.
Is SHA-256 safe for passwords?
Not on its own. It is fast, which helps attackers guess. Use Argon2id, bcrypt or PBKDF2 with a unique salt per password.
Is my data uploaded?
No. Hashing happens locally with the SubtleCrypto API. Nothing is sent, logged or saved.
A fast hash is not a password hash
SHA-256 has no known practical collision or preimage attack, so it is suitable for integrity checks and signatures. It is deliberately fast, so do not use it alone to store passwords: OWASP recommends slow, salted schemes such as Argon2id, bcrypt or PBKDF2.