SHA-256 Hash Generator Online - text and file checksum

What SHA-256 is

SHA-256 is a hash function from the SHA-2 family, published by NIST in 2001. It turns any input, from one word to a disk image of several GB, into a 256-bit fingerprint written as 64 hexadecimal characters. The same input always gives the same hash, and changing a single character changes the whole result. That is why SHA-256 is the usual choice for download checksums, TLS certificates, Docker image digests, Bitcoin and webhook signatures.

How a hash behaves

The SHA-256 hash function turns any input into a fingerprint with a fixed length of 64 characters.

Change a single letter and the hash is completely different. 60 of the 64 characters changed.

The same input always gives the same hash. That is how you check a download: compare its hash with the published one.

It only works in one direction. You cannot directly calculate the original data from the hash.

How to generate a SHA-256 hash

Add text or a file

Type or paste text, or switch to File and drop the file on the page. The SHA-256 hash updates as you type.

Choose the format

Lowercase hex is what sha256sum and most websites show. PowerShell prints uppercase HEX. Base64 is used by Subresource Integrity and some APIs.

Copy or compare

Copy the hash with one click, or paste the expected checksum into the compare field to see whether it matches.

SHA-256 at a glance

A SHA-256 hash always has the same length, whatever you hash. If a string you were given as "SHA-256" is shorter or longer, it is another algorithm or another encoding.

Property	Value	What it means
Length	256 bits, 32 bytes	The same for any input, from an empty field to a file of many GB.
Hex	64 characters	For example, the SHA-256 of "hello" is `2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824`.
Base64	44 characters	Ends with one `=`. The same hash as hex, only written differently.
Empty input	`e3b0c442…`	If you get `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`, nothing was hashed. In scripts this usually means an empty variable or a file that did not load.
Security	No practical attack	No one has found two inputs with the same SHA-256, so it is safe for checksums and signatures.

How to check a SHA-256 checksum

Linux distributions, installers and firmware usually publish a SHA-256 checksum next to the download. If it matches the hash of your file, the download is complete and has not been changed. Take the checksum from the official page, not from a mirror.

Find the SHA-256 checksum on the download page. It is often listed next to the link or in a SHA256SUMS file.
Switch the generator to File and choose the downloaded file.
Paste the checksum into Compare with a hash. A green message means the file is OK.

SHA-256 checksum on Windows, Mac and Linux

Windows 10 and 11, macOS and Linux can calculate SHA-256 without extra software. Replace file.iso with the name of your file.

Windows (PowerShell): Get-FileHash .\file.iso -Algorithm SHA256
Windows (PowerShell), compare with the checksum: (Get-FileHash .\file.iso).Hash -eq "paste the checksum here"
Windows (Command Prompt): certutil -hashfile file.iso SHA256
macOS: shasum -a 256 file.iso
Linux: sha256sum file.iso
Linux, check against a SHA256SUMS file: sha256sum -c SHA256SUMS --ignore-missing

HMAC-SHA256: SHA-256 with a secret key

HMAC-SHA256 mixes a secret key into the hash, so only someone who knows the key gets the right result. GitHub signs webhooks this way and sends sha256= plus the hex result in the X-Hub-Signature-256 header. Shopify sends the result in Base64 in X-Shopify-Hmac-Sha256. To check a signature, turn on HMAC with a secret key, enter the secret, paste the request body exactly as it arrived and pick hex or Base64 to match the service.

Is SHA-256 with a salt enough for passwords?

No. SHA-256 is built to be fast, so a graphics card can try billions of passwords per second, salt or no salt. For passwords use a function that is deliberately slow: Argon2id, bcrypt or scrypt. If a standard requires SHA-256, use PBKDF2-HMAC-SHA256 with a high iteration count. OWASP recommends 600,000 iterations.

Related Tools

More tools for preparing, editing, and checking text.

MD5 Hash Generator

MD5 of text or a file, checksum check

Open

Hash Generator

MD5, SHA-256 and SHA-512 from text and files

Open

Password Generator

Secure passwords online

Open

Base64 Encoder/Decoder

Encode and decode Base64 strings

Open

FAQ

Can a SHA-256 hash be decrypted or decoded?

No. SHA-256 is not encryption, so there is no key to decrypt it with, and the original text cannot be rebuilt from the hash. Sites that offer a "SHA-256 decoder" only look the hash up in a database of hashes of common words and leaked passwords. That works for "password123", not for a long or random input.

How long is a SHA-256 hash?

Always 256 bits, which is 32 bytes. Written in hex that is 64 characters, and in Base64 it is 44 characters ending with =. The length does not depend on the input, so the hash of one letter is as long as the hash of a 4 GB file.

What is the difference between SHA-256 and MD5?

MD5 gives a shorter, 32-character hash and is broken: two different files with the same MD5 can be created on a laptop in seconds. For SHA-256 no such attack is known. If a download page lists both checksums, check the SHA-256. For MD5 there is a separate MD5 hash generator.

Is SHA256 the same as SHA-256 or SHA-2?

SHA256, SHA-256 and sha256 are just different spellings of the same algorithm. SHA-2 is the family it belongs to, together with SHA-224, SHA-384 and SHA-512. When a tool or a website asks for a "SHA-2 checksum", it almost always means SHA-256.

Why does my SHA-256 differ from the terminal or another tool?

Almost always because of an invisible character. echo "hello" | sha256sum hashes "hello" plus a newline, so use echo -n or printf. Line breaks from Windows (CR LF), a trailing space or a different text encoding change the hash too. Files are hashed byte by byte, so for files the result matches every tool.

Does uppercase or lowercase matter?

Not in hex. PowerShell prints uppercase, sha256sum and certutil print lowercase, and it is still the same hash. The compare field accepts both. Base64 is case-sensitive, though.

How do I get a SHA-256 hash for Subresource Integrity?

Switch to File, choose the script or stylesheet exactly as the server delivers it and set the format to Base64. Put the result after sha256- in the integrity attribute, for example integrity="sha256-…".

Is my text or file uploaded anywhere?

No. The SHA-256 is calculated in your browser and neither the text nor the file leaves your computer. The file is read in parts, so even a disk image of several GB works.