SHA-256 Hash Generator

How to use the hash generator

Type or paste text and the hash updates as you type. The text is encoded as UTF-8 before hashing, which is what almost every programming language and command-line tool does. Pick a different algorithm from the Algorithm list at any time.

To hash a file, use Or hash a file. The file is read on your device with the FileReader API and hashed with crypto.subtle.digest; it is never uploaded. Typing in the text box switches back to hashing text.

The result is shown in two encodings of the same bytes. Hex (64 characters for SHA-256) is the usual format for checksums. Base64 (44 characters) is shorter and is used, for example, in Subresource Integrity attributes. The uppercase option only changes how hex is displayed; hex digests are not case-sensitive.

Worked examples

The last two rows show the most common surprise: echo "hello" | sha256sum hashes six bytes, because echo adds a line break. Use printf '%s' "hello" or echo -n to match this tool. To check a downloaded file, compare the hex value here with the output of sha256sum file on Linux, shasum -a 256 file on macOS or Get-FileHash file in PowerShell.

Which algorithm should you use?

• SHA-256 is the sensible default for checksums, content addressing and signatures.
• SHA-384 and SHA-512 come from the same SHA-2 family with longer output. SHA-384 is common in Subresource Integrity (integrity="sha384-...", the Base64 output).
• SHA-1 is broken for collision resistance: in 2017 researchers published two different PDF files with the same SHA-1. Use it only to match legacy systems, such as old Git object IDs.

Why MD5 is not offered

MD5 is not part of the browser's Web Crypto API, and that is deliberate: MD5 collisions can be produced in seconds on an ordinary laptop, so it no longer proves that a file is unmodified. Rather than ship a separate MD5 implementation that might suggest otherwise, this tool sticks to the algorithms the browser itself supports. If you must verify an old MD5 checksum, use md5sum or Get-FileHash -Algorithm MD5 locally, and prefer a SHA-256 checksum whenever one is published.

Common mistakes

• Hidden characters. A trailing newline, a Windows line ending (\r\n) or a space copied along with the text changes the hash completely.
• Different text encodings. Grüße in UTF-8 and in Latin-1 are different bytes and therefore different hashes. .NET's Encoding.Unicode is UTF-16, not UTF-8.
• Comparing hex with Base64. They are different spellings of the same digest; compare like with like.
• Storing passwords as plain SHA-256. Fast hashes are easy to brute-force. Use a password hashing function such as Argon2, bcrypt, scrypt or PBKDF2 with a salt.