SHA-256 Hash Generator
Turn any text into its 64-character SHA-256 digest — computed in this tab, never sent to a server.
What you get back
SHA-256 maps any input — one character or one gigabyte — to a fixed 256-bit value, written as 64 hexadecimal digits. The empty string hashes to e3b0c442..., and the string abc to ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Change one bit of input and roughly half the output bits flip.
Why run it in the browser
Pasting a password, an API key, a licence key or a customer record into a stranger's website means the operator — and anyone who reads their logs — can keep it. This page computes the digest with JavaScript running in your own tab. You can open DevTools, watch the Network tab, and confirm zero requests are made while you type.
Where SHA-256 actually shows up
- TLS certificates — the signature on the certificate securing this page is a SHA-256 signature (with the SHA-1 option withdrawn by all major CAs in 2016).
- JWT
HS256— the signature segment of an HS256 token isHMAC-SHA256(base64url(header) + "." + base64url(payload), secret). - Code signing and release checksums — distro mirrors publish
SHA256SUMSfiles so a corrupted or tampered download fails the check. - Content addressing — IPFS, container image layers, and rsync-style deduplication name objects by their digest.
SHA-256 is not a password hash
A plain SHA-256 of a password is fast to compute on purpose, which is exactly what an attacker wants: a single modern GPU tries billions of guesses per second. Password storage needs a deliberately slow, memory-hard function — Argon2id, scrypt, or bcrypt — plus a per-user salt. Use SHA-256 for integrity, not for secrets.
How to use it
- Paste or type your text into the box above.
- Pick an output format — lowercase hex is the default — or leave the encoding alone.
- Copy the 64-character digest and compare it against the reference value you were given.
Worth knowing
- Digest length: 256 bits / 64 hex characters.
- Block size: 512 bits, 64 rounds, big-endian, standardised in FIPS 180-4.
- No practical collision or preimage attack against full SHA-256 has been published.
- The empty input is a valid input and has a well-known digest.
Limitations
- Hashing is one-way by design — there is nothing to decrypt.
- This page hashes text. For a file, use the file checksum verifier so the bytes are read directly rather than pasted.
- Very large inputs are limited by how much memory your browser tab can hold.
- Matching digests prove identical bytes, not that the content is safe or authentic.
Frequently asked questions
Is SHA-256 reversible?
Can I decode a SHA-256 hash back to a password?
Is this the same as the sha256sum command?
echo abc | sha256sum hashes the newline as well.