How to use the SHA-256 Hash Generator
- Type or paste text, or switch to File and choose a file.
- Read the SHA-256 hash in the highlighted row and click Copy.
- For HMAC-SHA256, type the secret key.
- To verify a download, paste its checksum into Compare with a hash.
What is SHA-256?
SHA-256 is part of the SHA-2 family designed by the NSA and published by NIST. It produces a 256-bit hash, written as 64 hex characters. No practical way is known to find two inputs with the same SHA-256, so it's used for software checksums, TLS certificates, code signing, Bitcoin and API signatures.
The SHA-256 of hello world is b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9.
Which hash should I use?
| Algorithm | Length | Use it for |
|---|---|---|
| MD5 | 128 bits (32 hex characters) | Checking downloads and finding duplicate files. Not secure: collisions can be made on purpose. |
| SHA-1 | 160 bits (40 hex) | Legacy systems and Git object IDs. Also broken for security. |
| SHA-256 | 256 bits (64 hex) | The safe default: checksums, signatures, blockchains, API request signing. |
| SHA-384 / SHA-512 | 384 / 512 bits | When a standard asks for them, or for extra margin. SHA-512 can be faster on 64-bit machines. |
Verify a download
Many sites publish a checksum next to a download. Switch to File, choose the file, and paste the published value into Compare with a hash. A green ✓ Match means your copy is identical to the original. The file is read in your browser and never uploaded, so this works for large and private files too.
HMAC
An HMAC mixes a secret key into the hash, so only someone who knows the key can produce the same value. APIs and webhooks, for example from Stripe, GitHub or Slack, sign requests with HMAC-SHA256. Type the secret into HMAC secret key and every hash becomes an HMAC.
Don't use these for passwords
MD5 and SHA hashes are designed to be fast, which makes guessing passwords fast too. Store passwords with a slow, salted algorithm such as Argon2, bcrypt or scrypt instead.
Frequently asked questions
How long is a SHA-256 hash?
256 bits: 64 hex characters, or 44 characters in Base64.
How do I make an HMAC-SHA256 signature for a webhook?
Paste the exact request body as the text and your signing secret as the HMAC key, then compare the SHA-256 row with the signature header. Some services send it in Base64: switch the format to compare.
Is my text or file uploaded?
No. Hashes are calculated in your browser: SHA with its built-in Web Crypto, and MD5 with code that runs on the page. It even works offline.
Can a hash be reversed?
No. A hash is one-way. Short or common inputs can sometimes be found by guessing, which is why passwords need slow, salted hashing.
Why is my hash different from another tool's?
The input must match byte for byte. Check for a trailing newline or space, and whether the text is UTF-8. Files are hashed exactly as they are.
What's the difference between hex and Base64?
They're two ways of writing the same bytes. Hex uses 0–9 and a–f; Base64 is shorter. Most checksums are published in hex.