Skip to content
koducathome

SHA-256 Hash Generator

Generate SHA-256 hashes of text or files — the standard checksum for downloads, APIs and integrity checks — in hex or Base64, entirely in your browser.

How to use this tool

Steps for using the Hash Generator.

  1. Type or paste text, or choose File to hash a file of up to 50 MB. SHA-256 is listed first; the other algorithms are shown below it for comparison.
  2. The digest updates as you type. Pick hex, HEX (uppercase) or Base64 to match the format you need.
  3. Click Copy next to SHA-256, or Copy all / Download for every digest.
  4. To check a download, paste its published checksum into Verify a checksum — the matching algorithm lights up green.

Example

SHA-256 of the classic test sentence

Text (UTF-8) — the Sample button
The quick brown fox jumps over the lazy dog
SHA-256 (hex)
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

Common use cases

  • Verifying downloads, ISO images and release artifacts against published checksums.
  • Content addressing and cache keys that must not collide.
  • Checking that two copies of a file are identical.
  • Computing the body hash used by request-signing schemes such as AWS Signature V4.

Why SHA-256 is the default checksum

SHA-256 is part of the SHA-2 family and produces a 256-bit digest — 64 hexadecimal characters. No practical collision or preimage attack is known, which is why it is the default for download checksums, software signing, blockchain hashing and API request signing.

Like every good hash, it has an avalanche effect: adding a single full stop to the test sentence (second example) changes the digest completely. That makes it ideal for proving that a file or message has not changed.

To verify a download, hash the file here and compare it with the SHA-256 published by the vendor — paste theirs into Verify a checksum. If the digests match, the file is byte-for-byte what they published.

This page uses the browser's Web Crypto API (crypto.subtle.digest). Files up to 50 MB are read locally and never uploaded. A plain SHA-256 is not a password hash, though: for passwords use a slow, salted algorithm such as bcrypt or Argon2.

Limitations

  • A fast hash is not a password hash — use bcrypt, scrypt or Argon2 for passwords.
  • Files up to 50 MB in the browser; use sha256sum or shasum -a 256 for larger files.
  • For keyed signatures (webhooks, APIs) you need HMAC-SHA256, not a plain hash.

Frequently asked questions

Is SHA-256 secure?

Yes — no practical attack on SHA-256's collision or preimage resistance is known, and it is recommended by NIST for general use.

How do I check a file's SHA-256?

Choose File, then paste the published checksum into Verify a checksum. On the command line, sha256sum file (Linux), shasum -a 256 file (macOS) or Get-FileHash file (PowerShell) give the same value.

Why does my SHA-256 differ from the command line?

Usually a newline: echo text | sha256sum hashes the text plus a trailing newline. Use printf %s text | sha256sum to hash the text alone, as this page does.

How long is a SHA-256 hash?

256 bits — 64 hexadecimal characters, or 44 characters in Base64 (with one =).