SHA-256 Hash Generator & Checksum Tool

What Is SHA-256?

// Hash text using Web Crypto API (SHA-256)
async function sha256(text) {
  const data = new TextEncoder().encode(text);
  const hash = await crypto.subtle.digest('SHA-256', data);
  return Array.from(new Uint8Array(hash))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}

await sha256('Hello, World!');
// → 'dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f'

SHA-256 Examples

ubuntu-24.04.iso

-----BEGIN CERTIFICATE-----MIIDXTCCAkWg...

/* CSS file contents */

password123

ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f

How to Generate SHA-256 Hashes

1. 1

   Paste text or drop a file

   Select Text tab and paste any string into the input area, or switch to File tab and drag a file from your desktop into the dropzone. The SHA-256 algorithm picker is already active. Hashing happens as you type — no Generate button to click. For files, a progress indicator shows during large uploads (>10 MB).

2. 2

   Copy the 64-character hash

   Click the Copy button next to the hash output. The full 64-character hex value goes to your clipboard. Use the Uppercase/Lowercase toggle if your downstream system requires a specific case — Git uses lowercase, some Windows tools default to uppercase.

3. 3

   Verify with the Compare tab

   Switch to the Compare tab and paste two SHA-256 hashes (e.g., yours and a publisher's). The tool reports match/mismatch with constant-time comparison, so the result does not leak timing information. Useful for verifying downloaded ISO files, container image digests, or signed JAR fingerprints.

Technical Details

Algorithm: SHA-2 family, Merkle-Damgård construction

SHA-256 processes input in 512-bit blocks, applying 64 rounds of bitwise operations (rotations, XORs, additions modulo 2^32) with constants derived from the cube roots of the first 64 primes. The final hash is the internal state after the last block. Implementation: FIPS 180-4 sections 4.2 and 6.2.

Output: 256 bits, 64 hex characters

Always exactly 64 characters in the range [0-9a-f] (lowercase) or [0-9A-F] (uppercase). Different encodings (Base64, Base64URL) shorten the string; this tool outputs the canonical hex form.

Performance: ~500 MB/s in browser, ~2 GB/s native

Web Crypto's SHA-256 implementation is compiled C/Rust running outside the JS VM, so it is competitive with native tools. Typical browser hash rate: 300-800 MB/s. A 1-GB file hashes in 1-3 seconds.

Standards: FIPS 180-4, RFC 6234, NIST SP 800-107

Currently approved by NIST for all security strength levels through 2030 and beyond. Required by PCI DSS 4.0 for cardholder-data integrity, by FedRAMP, and by Common Criteria EAL2+ evaluations.

Best Practices

Always hash UTF-8 bytes, not Unicode code points

Different encodings of the same string produce different hashes. UTF-8 is the de facto standard; this tool encodes input as UTF-8 before hashing. If you need to match a tool that uses UTF-16 (some Windows APIs) or Latin-1, you need to pre-encode externally.

Use constant-time comparison when verifying

If you are comparing two hashes in code, use a constant-time equality check (timingsafe_equal in Node.js, hmac.compare_digest in Python). Naive === or strcmp leaks timing information that can be exploited to recover the hash. This tool's Compare tab already uses constant-time comparison.

Truncating SHA-256 is acceptable for non-security uses

For cache-busting filenames or short content IDs, taking the first 8 or 16 hex chars of a SHA-256 hash is fine — collision probability is still astronomically low at internet scale. For cryptographic use (signatures, fingerprints), always keep the full 64 chars.

Pair with a salt for any keyed use

If you are using SHA-256 to derive a key or token from a secret, always include a unique salt per input. Without a salt, identical inputs produce identical hashes — which leaks information. Better: use HKDF (RFC 5869) or HMAC-SHA-256 instead of raw SHA-256 for key derivation.

SHA-256 FAQ