SHA-256 Generator

Runs in browser Security

Compute SHA-256 digests locally with WebCrypto. Output as lowercase/uppercase hex or Base64, and compare against an expected hash.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What is a cryptographic hash?

A cryptographic hash turns any input into a fixed-size digest (32 bytes for SHA-256) such that the same input always gives the same digest, a one-character change gives a completely different one, and the input cannot be recovered from the output. Hashes verify file integrity, fingerprint content and underpin signatures and HMAC. SHA-256 and the SHA-2 family are current; MD5 and SHA-1 are broken against deliberate collisions and should only be used as checksums.

Security note: A plain hash is not a password store. Passwords need a slow, salted algorithm — Argon2id, scrypt or bcrypt — because SHA-256 and MD5 can be tried billions of times per second.

A SHA-256 digest is always 64 hex or 44 Base64 characters (43 without padding), so an expected hash of another length was made with another algorithm or format.
AlgorithmDigest sizebitsHexcharsBase64charsStatus
MD512816 bytes322422 unpaddedBrokenChecksums only
SHA‑116020 bytes402827 unpaddedBrokenChecksums only
SHA‑25625632 bytes644443 unpaddedCurrentSHA-2
SHA‑38438448 bytes966464 unpaddedCurrentSHA-2
SHA‑51251264 bytes1288886 unpaddedCurrentSHA-2
  • This tool

Lengths come from the tool’s own hash engine; uppercase hex has the same length, and Base64url the length without padding. None of these alone is a password store: use Argon2id, scrypt or bcrypt.

How to use SHA-256 Generator

  1. Paste the text to hash.
  2. Select the output format.
  3. Paste an expected hash to verify a match.
  4. Copy or download the digest.

SHA-256 Generator features

  • SHA-256 computed with WebCrypto — fast and fully local
  • Lowercase/uppercase hex, Base64, Base64url and binary output
  • Compare against an expected digest (accepts "sha256=" prefixes)
  • Whitespace trimming to match printf-style inputs
  • Live hashing with input size and byte count

SHA-256 Generator example

SHA-256 of "abc"

Input:

abc

Output:

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Frequently asked questions about SHA-256 Generator

Is SHA-256 suitable for storing passwords?

Not on its own. It is fast, which helps attackers. Use a purpose-built password hash (Argon2id, bcrypt or scrypt) with a salt. SHA-256 is ideal for integrity checks, content addressing, HMAC and signatures.

How do I verify a downloaded file's checksum?

Paste the published hash in "Compare with expected hash". For files, compute the digest with "sha256sum file" (Linux/macOS) or "Get-FileHash file" (PowerShell) and compare — this tool hashes text, not uploaded files.

Uppercase or lowercase hex — does it matter?

They represent the same bytes. Most tools print lowercase; the comparison here ignores case and also accepts Base64.

What is the output size?

256 bits: 64 hex characters or 44 Base64 characters (43 without padding).

Technical notes

SHA-256 belongs to the SHA-2 family standardised in FIPS 180-4 and is the default choice for integrity checks, HMAC, TLS and code signing. The digest is deterministic: the same UTF-8 bytes always produce the same 256-bit value.

References