Hunt
Skip to content

SHA-256 Hash Generator

Type text or choose a file to get its SHA-256 hash, the checksum used to verify downloads, sign data and identify content. Compare it with an expected hash to check a file hasn't been altered. MD5, SHA-1, SHA-384 and SHA-512 are shown too. Everything is calculated in your browser, including large files.

Runs in your browser

Text

Text is hashed as UTF-8 bytes, exactly as typed: a trailing space or line break changes the hash.

Hashes

SHA-256
MD5not for security
SHA-1not for security
SHA-384
SHA-512

What SHA-256 is for

SHA-256 turns any input into a 256-bit value (64 hex characters). Changing a single byte of the input changes the hash completely, and no practical way is known to find two inputs with the same hash. That makes it the standard way to check that a downloaded file matches what was published, and the basis of Git object IDs, Docker image digests, Subresource Integrity and many signatures.

To verify a download, choose the file and paste the checksum from the publisher's site into Compare with.

How to use the SHA-256 Hash Generator

  1. Type or paste text, or switch to File and choose or drop a file.
  2. Read the SHA-256 hash, or another algorithm's, as hex or Base64.
  3. Paste an expected hash into Compare with to check it matches.

Examples

A short text

Input
hello world
Output
b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

The same text with a line break

Input
hello world
Output
a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447

This is what echo "hello world" | sha256sum gives, because echo adds a line break. Use echo -n or printf to hash the text alone.

An empty input

Input
Output
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Worth recognising: a hash starting e3b0c442 means something hashed nothing, often an empty file or an unset variable.

Not for passwords

SHA-256 is fast, which is good for checksums and bad for passwords: an attacker can try billions of guesses per second. Store passwords with a slow, salted algorithm such as Argon2, scrypt or bcrypt.

Options

Hash
Text (hashed as UTF-8) or a file (hashed byte for byte).
Output
Lowercase hex (as sha256sum prints), uppercase hex, or Base64 (as used in Subresource Integrity and many APIs).
Compare with
Paste a hash in hex or Base64 to see whether it matches any of the algorithms.

Limitations

  • Files up to 500 MB, held in memory while they're hashed.
  • Text is hashed as UTF-8; to hash text in another encoding, save it as a file first.

Frequently asked questions

Is my file uploaded?

No. The file is read and hashed in your browser with its built-in Web Crypto API; it never leaves your device.

Why doesn't my hash match the one from the command line?

Usually a line break: echo adds one, and so do most editors at the end of a file. Also check the encoding: this tool hashes text as UTF-8.

Can a SHA-256 hash be reversed?

No. A hash can't be turned back into its input. Short or common inputs, like simple passwords, can be found by guessing, which is why passwords need a slow hash.

How do I hash in code?

In browsers and Node.js: crypto.subtle.digest("SHA-256", new TextEncoder().encode(text)). In Node.js also createHash("sha256").update(text).digest("hex"). In a shell: sha256sum file or shasum -a 256 file.