All Tools

SHA-256 Generator

Get the SHA-256 hash of any text or file in hex or Base64, sign messages with HMAC-SHA256, and verify a download against its published SHA-256 checksum.

Runs in your browser — nothing is uploaded Free, no limits

Text to hash

0 bytes · updates as you type
Paste a published checksum — hex is matched case-insensitively, spaces are ignored.

Hashes

SHA-256
—
MD5not for security
—
SHA-1not for security
—
SHA-384
—
SHA-512
—
MD5 and SHA-1 are broken for security. Collisions can be crafted, so don't use them for signatures, certificates or password storage. They're still fine for checksums and detecting accidental corruption. For passwords use a slow hash such as Argon2, bcrypt or scrypt.

How to use the SHA256 Generator

  1. Type or paste your text, or switch to File and choose a file.
  2. The SHA-256 hash appears at the top as you type (SHA-1, SHA-384, SHA-512 and MD5 are shown below it).
  3. Tick HMAC and enter a secret key to create an HMAC-SHA256 signature.
  4. Paste the expected checksum into the compare box to verify the file or text.

Frequently asked questions

What is SHA-256?

SHA-256 is a member of the SHA-2 family designed by the NSA and standardised by NIST in FIPS 180-4. It produces a 256-bit (32-byte) hash, usually written as 64 hexadecimal characters.

Is SHA-256 secure?

Yes. There are no known practical collision or preimage attacks on SHA-256, and it's used in TLS certificates, code signing, Git (SHA-256 mode) and Bitcoin. For storing passwords, though, use a slow algorithm like Argon2 or bcrypt.

Can a SHA-256 hash be decrypted?

No. Hashing is one-way — there is no key to decrypt it. Online 'decrypters' only look up hashes of common words and leaked passwords in precomputed tables.

How do I verify a file's SHA-256 checksum?

Switch to File, choose the downloaded file and paste the checksum from the publisher's website into the compare box. A green match means the file is identical to the original. On the command line you can use ‘sha256sum file’ (Linux), ‘shasum -a 256 file’ (macOS) or ‘Get-FileHash file’ (PowerShell).

What is HMAC-SHA256 used for?

HMAC-SHA256 signs a message with a shared secret key. APIs and webhooks (Stripe, GitHub, AWS Signature V4 and many others) use it so the receiver can check that a request is authentic and unmodified.

Is my data sent to a server?

No. The SHA-256 hash is calculated in your browser with the Web Crypto API. Your text, files and keys never leave your device.