Skip to content
cliplimeClipLime

SHA-256 hash generator

The SHA-256 hash of text or a file, and a one-step check against the checksum you were given.

Runs on your device, nothing is uploaded

Hashes update as you type.

Your text

Hashes

Working out the hashes…

Paste the hash you expect. It can be hex, Base64, or a whole line from sha256sum or md5.

Do not use these to store passwords

MD5 and SHA-1 are broken for security: different inputs with the same hash can be made on purpose. All five algorithms here are also built to be fast, which is exactly wrong for passwords, because it lets an attacker try billions of guesses a second. Store passwords with a slow, salted function such as Argon2, scrypt or bcrypt. Use SHA-256 or SHA-512 for checksums and fingerprints.

At a glance

Digest
256 bits, shown as 64 hex characters or 44 characters of Base64.
Input
Text, hashed as UTF-8, or any file of any size, read in pieces.
Family
SHA-2, published by NIST in 2001. SHA-384 and SHA-512 are on the same page.
Used for
Download checksums, TLS certificates, Docker image digests, Subresource Integrity and Bitcoin.
Compare
Paste a SHA-256 checksum, or a line from sha256sum, and see Match or No match.
Speed
Uses your browser's native Web Crypto for files that fit in memory, so it is quick.
Privacy
Runs in your browser. Nothing is uploaded.

How to do it

  1. 1

    Pick Text or File

    Type or paste text, or choose a file such as an installer or a disk image. Very large files are read in chunks.

  2. 2

    Copy the SHA-256 line

    The SHA-256 hash is shown first. Press Copy, or switch to Base64 or upper-case hex with the buttons above the results.

  3. 3

    Check it against the publisher

    Paste the checksum from the vendor into Compare with a hash. Match means your file is identical to the one they hashed.

What SHA-256 is used for

SHA-256 is the 256-bit member of the SHA-2 family. It is the usual choice when you need a fingerprint that nobody can forge in practice. You meet it in several places:

  • Download checksums published next to installers and disk images.
  • TLS certificates, most of which are signed over a SHA-256 hash of their contents.
  • Docker and container registries, where an image is identified by a digest like sha256: followed by 64 hex characters.
  • Subresource Integrity, the integrity attribute on script and link tags, which accepts SHA-256, SHA-384 and SHA-512.
  • Bitcoin, which uses double SHA-256 for block hashes and transaction identifiers.

Verifying a file with SHA-256

Hash the file on this page and compare the result with the checksum the publisher lists. If they match, every byte of your copy is identical to theirs. If they do not, download again, and if it still fails, do not run the file.

To confirm a result with another tool: sha256sum file on Linux, shasum -a 256 file on macOS, and Get-FileHash file -Algorithm SHA256 in Windows PowerShell. A checksum only helps if it comes from a trustworthy place: one stored on the same compromised server as the file proves nothing.

What SHA-256 does not do

SHA-256 is not a password hash. It is fast, so stolen hashes can be guessed at enormous speed. Use Argon2, scrypt or bcrypt with a salt for passwords.

It is also not a message authentication code. Prefixing a secret to a message and hashing it with plain SHA-256 is vulnerable to length extension, where an attacker appends data and computes a valid new hash. Use HMAC-SHA-256 for that job.

SHA-256 or SHA-512?

Both belong to SHA-2 and neither has a known practical attack. SHA-256 gives 64 hex characters and is what most tools and websites list. SHA-512 gives 128 and can be quicker on 64-bit processors for large inputs, while SHA-384 is a trimmed SHA-512 that is not exposed to length extension. If a publisher gives you one, check that one.

Questions people ask

How long is a SHA-256 hash?

256 bits, which is 64 hexadecimal characters or 44 characters of Base64 including the padding. Every SHA-256 result is the same length however big the input is.

What is the SHA-256 of an empty string?

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. You will see it here when the text box is empty.

Is SHA-256 secure?

Yes, for hashing and fingerprints. No practical way is known to find two inputs with the same SHA-256 or to work backwards from a hash. It is not suitable for storing passwords on its own, because it is too fast.

Can SHA-256 be reversed?

No. A hash throws information away, so the original cannot be worked out from it. Only guessable inputs can be found, by hashing candidates and comparing.

Is SHA-256 the same as SHA-2?

SHA-2 is a family: SHA-224, SHA-256, SHA-384, SHA-512 and two truncated variants. SHA-256 is one member of it, and SHA-384 and SHA-512 are also on this page.

Is my file uploaded to be hashed?

No. The browser reads the file from your disk and calculates the hash on your device. Nothing is sent anywhere.

Guides that help

All Data and developer guides →

Data and developer

The download page prints a long string of letters next to the button. Here is how to check it in a minute

5 min readRead

Data and developer

Length beats cleverness: how long a password should be, and the arithmetic that proves it

6 min readRead

Data and developer

Base64 looks like encryption and is not. What it does, why it exists and why your decode fails

6 min readRead

Pairs well with

Hash Generator

Hash text or files with MD5, SHA-1, SHA-256, SHA-384 and SHA-512, and check a download against its published hash.

Opens Text, any file · Saves Copied hashes

Open tool

Password Generator

Make random passwords and passphrases and see how many bits of entropy they have.

Opens Nothing to open · Saves Copied text

Open tool

Data Converter

Convert CSV, TSV, JSON, XML, YAML and Excel files into each other, with nested data and large files handled.

Opens CSV, TSV, JSON, XML, YAML, XLSX · Saves CSV, TSV, JSON, XML, YAML, XLSX

Open tool

Base64 Encoder and Decoder

Encode and decode Base64 for text, files and images, with URL-safe and line wrapped options.

Opens Text, any file, Base64 strings · Saves Base64 text, decoded files

Open tool