SHA-256 Hash Generator
Generate SHA-256 hashes of text or files instantly. Verify downloads against a checksum, create HMAC-SHA256 signatures and hash every line in bulk — computed on your device with the browser's native Web Crypto engine.
| Other hashes of your input appear here. |
What Is SHA-256?
The 256-bit member of the SHA-2 family — the workhorse hash of the modern web.
SHA-256 turns any input — a word, a document, a 4 GB ISO — into a fixed 256-bit fingerprint, written as 64 hexadecimal characters. Change a single bit of the input and the hash changes completely, and there is no practical way to go from a hash back to the input or to find two inputs with the same hash.
It secures TLS certificates, Bitcoin, Git's new object format, software downloads, package lockfiles (sha256-… integrity), JWT HS256/RS256 signatures and AWS request signing.
This tool hashes the exact UTF-8 bytes of your text, so results match sha256sum, Python's hashlib, Node's crypto and every other standard implementation. Watch out for invisible differences: a trailing newline or space produces a different hash.
For passwords, a plain SHA-256 is not enough — it is designed to be fast, which helps attackers. Store passwords with a slow, salted algorithm such as Argon2, bcrypt or scrypt.
Output Formats & Modes
Everything you need for checksums, signatures and integrity hashes.
Hexadecimal (64 chars)
The standard format used by sha256sum, download pages and most APIs. Switch to HEX for uppercase.
Base64 (44 chars)
The compact form used in Subresource Integrity (integrity="sha256-…"), Content-Security-Policy hashes and many webhook signatures.
HMAC-SHA256
A keyed hash for verifying webhooks (Stripe, GitHub, Slack, Shopify) and signing API requests. Tick HMAC and enter the shared secret.
Hash each line
Bulk mode: one SHA-256 per input line, in order — handy for hashing lists of emails or IDs (up to 100,000 lines).
How to Use the SHA-256 Hash Generator
Get your result in under ten seconds.
Type text or drop a file
Paste text to hash it live, or switch to File mode and drop any file to compute its checksum.
Pick a format and options
Choose hex, uppercase HEX or Base64. Tick HMAC to sign with a secret key, or Each line for bulk hashing.
Copy, download or verify
Copy the hash, download a sha256sum-compatible checksum file, or paste an expected hash to check it matches.
Why Use the SHA-256 Hash Generator on Developers Web Tools
Fast, accurate and private — built for developers.
Private by design
Text and files are hashed on your device with the Web Crypto API. Nothing is uploaded, logged or stored.
Native speed
Uses the browser's built-in, hardware-accelerated SHA-256. Large files are hashed in a background worker so the page never freezes.
Files up to 512 MB
Verify ISO images, installers and archives against the checksum published by the vendor.
Instant verification
Paste the expected checksum — hex or Base64, any case — and see a clear match or mismatch.
HMAC built in
Generate HMAC-SHA256 signatures to debug webhooks and API authentication.
Other algorithms too
See MD5, SHA-1, SHA-384 and SHA-512 of the same input side by side.
Frequently Asked Questions
No. Hashing is one-way: there is no key and no way to compute the input from the hash. Short or common inputs can sometimes be found by guessing ("rainbow tables"), which is why passwords need a salt and a slow algorithm.
Almost always the input bytes differ — a trailing newline (common with echo; use echo -n), Windows CRLF line endings, a leading BOM or a different text encoding. This tool hashes your text exactly as typed, as UTF-8. Browsers always use LF line endings in text boxes, so to hash a CRLF file byte-for-byte, use File mode.
Switch to File mode, drop the file and paste the checksum from the vendor's website into Verify a checksum. A green ✓ Match means the file is intact and unmodified.
HMAC combines a secret key with the message so only someone with the key can produce the signature. Services like Stripe, GitHub and Slack sign webhook payloads this way; compute it here to debug a signature mismatch.
Yes. SHA-256 has no known practical collision or pre-image attacks and is approved for use by NIST. For password storage, use Argon2, bcrypt or scrypt instead of a single fast hash.
No. Files are read and hashed locally in your browser. This page works offline once loaded, and nothing is kept after you close the tab.
Subresource Integrity attributes and CSP hashes use Base64 SHA-256 (or SHA-384/512), for example integrity="sha256-…". Select Base64 to get exactly that value.