Summary: generate a SHA-256 hash, free and private
A SHA-256 hash generator turns any text or file into a 256-bit fingerprint, written as 64 hexadecimal characters. To generate a SHA-256 hash free and privately, type or paste text into Text Input above, or click Choose File, and the hash appears under SHA-256. The hashing runs in your browser; nothing is uploaded, and you can check that in the Network tab of DevTools.
SHA-256 belongs to the SHA-2 family, which NIST specifies in FIPS 180-4. The same input always gives the same hash and any change gives a different one, so a published checksum lets you confirm a download is intact. Tick HMAC-SHA-256 to mix in a secret key and produce a signature instead. The older MD5 hash generator is there for legacy checksums.
Table of Use: inputs and their SHA-256 values
| Input | Result | What it shows |
|---|---|---|
| hello | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 | The standard example |
| Hello | 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 | A capital letter changes the whole hash |
| hello followed by Enter | 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03 | The line break is part of the input |
| abc | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad | The first test vector in the NIST examples |
| The quick brown fox jumps over the lazy dog | d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592 | A common test sentence |
| hello, with Output format set to Base64 | LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ= | The same 32 bytes written in Base64 |
| HMAC, key "key", the fox sentence | f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 | Tick HMAC-SHA-256 and enter the key |
| HMAC, key "secret", message "hello" | 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b | Same message, different result from the plain hash |
HMAC-SHA256: a SHA-256 hash with a secret key
HMAC is a keyed hash: only someone who knows the secret key can produce or check the value. It is defined in RFC 2104 as HMAC(K, m) = SHA-256((K′ ⊕ opad) ∥ SHA-256((K′ ⊕ ipad) ∥ m)), where K′ is the key, hashed first if it is longer than 64 bytes, then padded with zeros to the 64-byte block size. APIs, webhooks and JWTs that use HS256 sign their messages this way. Webhooks and APIs usually send the signature in hex or Base64, so pick the Output format that matches. A JWT signature is Base64url without padding, which Output format does not offer; paste it into Compare Hash, which accepts it.
SHA-256 compared with MD5
| Feature | SHA-256 | MD5 |
|---|---|---|
| Hash length | 256 bits, 64 hex characters | 128 bits, 32 hex characters |
| Practical collision attacks | None known | Known since 2004 |
| Published as | FIPS 180-4 from NIST | RFC 1321 from the IETF |
| Keyed mode (HMAC) on this tool | Yes | No |
| Good for | Download checks, signatures, API signing | Legacy checksums, duplicate detection |
Features
- Text as UTF-8, exactly as typed. Line breaks count, and the hash updates as you type. The hashing code loads the first time you type or choose a file.
- Files of any type and size. Files are read in 4 MB chunks, with a progress bar and a Cancel button.
- HMAC-SHA-256 (keyed hash). Enter the Secret key as Text (UTF-8) or Hex bytes; an invalid hex key gets an error. It works on files as well as text.
- Hex or Base64. Output format offers Hex (64 characters) or Base64, and Uppercase hex applies to hex only.
- Compare Hash. Accepts the expected value in any case, with extra spaces, in Base64 or URL-safe Base64, or as a whole sha256sum or BSD-style line.
- Checksum download. A plain file digest downloads as a line in lowercase hex named after the file, such as notes.zip.sha256, which sha256sum -c can check. Text hashes download as sha256-hash.txt and HMACs as hmac-sha256-hash.txt.
- Recent Hashes. The last 10 entries stay on the page while it is open, and each HMAC entry remembers its key in memory so clicking it restores the key. They are cleared when you leave or reload the page, not by Reset.
To re-encode a digest, the Base64 encoder and Base64 decoder are close by, and the hex to binary converter shows a digest as bits. If two hashes of supposedly identical text differ, the text diff tool shows what changed. When you need reversible protection instead of a hash, use the text encryption tool.
How to Use the SHA-256 Hash Generator
- Type or paste text into Text Input, or click Choose File and pick a file. A file replaces the text, and typing replaces a file.
- Read the hash in the result box. Under Output format choose Hex or Base64, and tick Uppercase hex if you need capitals.
- For an HMAC, tick HMAC-SHA-256 (keyed hash), enter the Secret key and choose its Key format.
- To verify, paste the expected value into Compare Hash and read the green or red message.
- Click Copy or Download, or click a Recent Hashes entry to show it again. Reset clears the text, file, Compare Hash and HMAC key; Recent Hashes, which remember the key used for each HMAC, stay until you leave or reload the page.
Who Can Use a SHA-256 Hash Generator
Administrators and careful users verify ISO images, installers and archives against the publisher's checksum. Developers build and test API request signatures and webhook checks, often alongside the JSON formatter for the payload, and can make random test secrets with the password generator. Anyone working with content-addressed systems, such as container image digests that begin with sha256:, can compare values here, and students use it to see the avalanche effect first hand. The file hash calculator is another way to hash a file.
FAQs
How do I generate a SHA-256 hash?
Type or paste text into Text Input and its SHA-256 hash appears as you type, as 64 hexadecimal characters. To hash a file, click Choose File: the file is read in chunks on your device and the hash appears when it finishes, with a progress bar for large files. Click Copy to copy it, or Download to save it.
How do I verify a download with a SHA-256 checksum?
Click Choose File and select the downloaded file, then paste the checksum published by the software provider into Compare Hash. The tool shows "Hashes match." or "Hashes do not match." straight away. It accepts upper or lower case, extra spaces, Base64 and whole lines from sha256sum or BSD-style checksum files. Take the checksum from the project's official site, not from the mirror that served the file.
Why is my hash different from the one sha256sum gives?
The input differs, most often by a trailing line break. echo "hello" | sha256sum hashes hello plus a newline and prints 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03, while echo -n "hello" gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, the value this tool shows. Hash a file with Choose File to match sha256sum exactly.
How do I create an HMAC-SHA256 signature online?
Tick HMAC-SHA-256 (keyed hash), type the Secret key, and set Key format to Text (UTF-8) or Hex bytes. Then type the message or choose a file. Pick Hex or Base64 output to match the service you are working with; a JWT signature is Base64url instead, which Compare Hash accepts. With the key "key" and the message "The quick brown fox jumps over the lazy dog", the result is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8.
Can I check a webhook or JWT signature with this tool?
Yes, if the signature is HMAC-SHA256. Paste the exact signed text, such as the raw webhook body or the header.payload part of a JWT, enter the shared secret, and paste the received signature into Compare Hash. Hex, Base64 and URL-safe Base64 are all accepted. The text must match byte for byte, including line breaks.
Is SHA-256 secure, and can it be reversed?
SHA-256 is a one-way function, so the input cannot be calculated from the hash, and no practical collision or preimage attack on it is known. Common inputs can still be guessed by hashing candidates, so passwords need a slow, salted hash. As of October 2026 the OWASP Password Storage Cheat Sheet recommends Argon2id first, and 600,000 iterations for PBKDF2-HMAC-SHA256.
What is the difference between SHA-256 and MD5?
SHA-256 gives a 256-bit hash of 64 hexadecimal characters; MD5 gives a 128-bit hash of 32. MD5 collisions can be created on purpose, while no practical collision attack on SHA-256 is known, so SHA-256 is the right choice wherever someone could tamper with the data. MD5 remains useful for legacy checksums and for non-security jobs such as finding duplicate files.
Are my files and secret key uploaded anywhere?
No. Hashing runs in your browser: files are read in 4 MB pieces on your device and there is no size limit. The secret key stays in the open tab and is never stored or sent anywhere. Recent Hashes lists the last 10 entries, remembering the key used for each HMAC, until you leave or reload the page. In the Network tab of DevTools you will see no request carrying your text, file or key.