Security Runs locally Ready to use Built-in examples No tracking

SHA-256 Hash Generator

Compute SHA-256 digests entirely in your browser with UTF-8 support.

SHA-256 is the hash still usable in modern security work: verifying a downloaded file, checking an API signature, deriving a cache key. Paste the text and a 64-digit hexadecimal digest comes back. It is a deterministic function, so the same input always yields the same output; change a single character, even a space, and the result changes completely — which is exactly what makes it usable as a fingerprint.

Two conventions that are easy to overlook. The first is encoding: this tool hashes UTF-8, so both sides must agree on the encoding before comparing, or the same text yields different digests. The second is irreversibility: a hash is not encryption, so the original cannot be recovered from the digest — the "decryption" services online are rainbow-table lookups. For security use, prefer SHA-256; MD5 and SHA-1 are for compatibility with old systems only.

—

How to use

  1. Paste the text to hash.
  2. Read the 64-digit hexadecimal digest.
  3. Confirm both sides agree on UTF-8 before comparing.
  4. Remember a hash can never be reversed into the original.

How it works

Basic usage

Paste or type content into the box and the digest generates in real time; change a single character — even one space — and the result changes completely.

Output and verification

The output is 64 hexadecimal characters (256 bits). When comparing checksums, confirm the encoding matches — this tool encodes as UTF-8, so the same visible text encoded as GBK hashes differently.

Why it can't be reversed

SHA-256 is a one-way function: the original cannot be recovered from the digest. Password verification works by "hashing the input and comparing", not "decrypting the hash".

Code example

JavaScript Computing with WebCrypto in the browser 

// Asynchronous API; the input is encoded as UTF-8
const buf = await crypto.subtle.digest(
  "SHA-256", new TextEncoder().encode(text));
const hex = [...new Uint8Array(buf)]
  .map((b) => b.toString(16).padStart(2, "0")).join("");

Shell Computing on the command line 

# Text (note -n drops the trailing newline, otherwise the result differs)
echo -n "hello" | shasum -a 256

# File
shasum -a 256 file.zip          # macOS / Linux
# Windows (cmd)
certutil -hashfile file.zip SHA256

FAQ

Can SHA-256 be decrypted?

No. Hashing is one-way compression, mathematically irreversible. Online "decryption" services are rainbow tables — precomputed hashes of common strings. This is exactly why stored passwords must be salted: it defeats the tables.

Why does the same string always produce the same hash?

SHA-256 is deterministic: identical input always yields identical output, which is precisely what makes checksums possible. Randomness belongs to salted hashing (a fresh salt each time) or HMAC — not to SHA-256 itself.

Does the empty string have a hash?

Yes. The SHA-256 of the empty string is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 — a famous standard test vector, useful for checking that a hash tool itself works correctly.

How long is the SHA-256 output?

Fixed at 256 bits — 64 hex characters (32 bytes). No matter how long the input, the digest length never changes; this is fundamental to hash functions and why they work for large-file integrity checks.

Hashing vs. encryption vs. encoding — what's the difference?

Hashing is one-way — the original can't be recovered; used for checksums and fingerprints. Encryption is reversible with the key; used for confidential transmission. Encoding (like Base64) only changes representation, is reversible by anyone, and offers no security. Three entirely different purposes.

SHA-256 or MD5 — which is better?

Prefer SHA-256. MD5 and SHA-1 both have proven collision attacks (two different inputs yielding the same digest) and are no longer fit for security — only for quick non-security checks. SHA-256 is still considered secure.

Can large files be hashed online too?

This tool computes locally in your browser and suits text and files up to about 10 MB. For bigger files use the command line — Windows: certutil -hashfile filename SHA256; macOS/Linux: shasum -a 256 filename — faster, and the file never gets uploaded.