SHA-256 hash generator for text and files
SHA-256 is today’s default cryptographic hash. A member of the SHA-2 family designed by the NSA and standardised by NIST in FIPS 180-4, it maps any input to a 256-bit value written as 64 hexadecimal characters. This SHA-256 hash generator computes that fingerprint for text you type or a file you upload, entirely in your browser.
Example
Input:
The quick brown fox jumps over the lazy dogSHA-256 hash:
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592Change “dog” to “cog” and the hash becomes e4c4d8f3bf76b692de791a173e05321150f7a345b46484fe427f6acc7ecc81be. Roughly half of the output bits flip for any change — the avalanche effect that makes hashes reliable fingerprints. The hash of an empty input, e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, is worth recognising: seeing it usually means something hashed nothing by mistake.
SHA-256 at a glance
| Property | Value |
|---|---|
| Digest size | 256 bits (32 bytes, 64 hex characters, 44 Base64 characters) |
| Block size | 512 bits; 64 rounds on 32-bit words |
| Structure | Merkle–Damgård with a Davies–Meyer compression function |
| Collision resistance | About 128 bits |
| Standard | FIPS 180-2 (2002), now FIPS 180-4 |
| Status | Secure; no practical attacks known |
Properties that make SHA-256 useful
- Deterministic: the same bytes always give the same hash, on every platform.
- Preimage resistant: given a hash, there is no feasible way to find an input that produces it.
- Collision resistant: finding two different inputs with the same hash would take around 2¹²⁸ operations.
- Fast: modern CPUs with SHA extensions hash well over a gigabyte per second per core.
Where SHA-256 is used
- Download verification. Publishers list SHA-256 checksums; compare with
sha256sum file(Linux),shasum -a 256 file(macOS) orGet-FileHash file(PowerShell’s default) — or upload the file here. - TLS certificates and code signing, where SHA-256 replaced SHA-1.
- Bitcoin mining and transaction IDs (double SHA-256), and many other blockchains.
- Content addressing in Docker image digests (sha256:…), Git’s SHA-256 object format and package lock files.
- API signing with HMAC-SHA256 — AWS Signature Version 4, webhook signatures and JWT HS256.
What SHA-256 is not for
Passwords. SHA-256 is designed to be fast, which is the opposite of what password storage needs: a GPU can try billions of SHA-256 guesses per second. Even salted SHA-256 is too quick. Use a deliberately slow, salted password hash — bcrypt, Argon2id, scrypt, or PBKDF2 with a high iteration count.
Secret-keyed MACs built by concatenation. Because SHA-256 uses the Merkle–Damgård construction, SHA256(secret + message) is vulnerable to length-extension attacks: an attacker who knows the hash can append data and compute a valid new hash without the secret. Use HMAC-SHA256, which is designed for exactly this.
And remember that a hash cannot be “decrypted”. Lookup sites can only find inputs that were already in their tables, which is why hashes of guessable data, such as phone numbers or short IDs, offer little privacy on their own.
Getting matching results
SHA-256 works on bytes. This tool encodes text as UTF-8, matching sha256sum, Python’s hashlib.sha256(s.encode()), Node’s crypto.createHash('sha256') and PHP’s hash('sha256', $s). The usual causes of mismatches are a trailing newline (echo adds one; use printf or echo -n), CRLF versus LF line endings, and invisible characters such as a byte order mark. Lowercase and uppercase hex represent the same value.
Need a different output length? The SHA-2 Hash Generator offers every SHA-2 variant in one place. Hashing is done locally in your browser, so files and text are never uploaded.