SHA-256 Hash Generator
Compute a SHA-256 digest of text or a file — the default choice for checksums, signatures and content addressing.
Input
SHA-256
Enter something above to see the result.
Why SHA-256 is the default
SHA-256 produces a 256-bit digest — 64 hexadecimal characters — and has no practical collision or preimage attacks after two decades of analysis. It is what TLS certificates, Git object ids (in newer versions), Bitcoin and package managers rely on.
It is computed here with the Web Crypto API, the same hardware-accelerated implementation the browser uses for HTTPS, so a large file hashes at hundreds of megabytes per second without leaving the machine.
What a matching hash does and does not prove
- It proves the bytes are identical to the ones that produced the published hash.
- It does not prove the publisher is trustworthy — only that you received what they sent.
- It does not protect against an attacker who can change both the file and the published hash. That is what signatures, not hashes, are for.
Frequently asked questions
Is SHA-256 the same as SHA-2?
SHA-2 is the family; SHA-256 is its most used member, alongside SHA-224, SHA-384 and SHA-512. SHA-3 is a separate, newer design, not a replacement forced by any weakness in SHA-2.
Can I hash a large file?
Yes. The file is read locally and hashed in the browser; the practical limit is your device memory rather than any upload size.
Should I use SHA-256 for passwords?
No. It is designed to be fast, which is exactly wrong for passwords. Use a deliberately slow function such as bcrypt, scrypt or Argon2.