Free tool · runs in your browser

SHA-256 hash generator

Type or paste text to get its SHA-256, SHA-1, SHA-384 and SHA-512 hashes instantly.

Text

Quick answer

A hash turns any input into a fixed-length fingerprint: the same input always gives the same hash, and a tiny change gives a completely different one. SHA-256 is the standard choice for checksums and integrity checks. This tool uses the browser's built-in Web Crypto API, and your text never leaves your device.

How to use it

Enter text. Type or paste it; hashes update as you type.
Pick the algorithm you need. SHA-256 for most uses; SHA-1 only for compatibility with old systems.
Copy the hash. Results are lowercase hexadecimal.

Example

The hashes of the word hello:

Input

hello

Output

SHA-256  2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-1    aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d

Common errors and how to fix them

My hash does not match another tool: The input is different, most often a trailing newline: echo "hello" | sha256sum hashes "hello\n" and gives 5891b5b5…. Use echo -n, and check spaces and letter case.
The same text gives different hashes in two languages: They encode the text differently, such as UTF-8 and UTF-16. Hash the UTF-8 bytes everywhere.
The hash has a different length or letters: One side shows hex and the other Base64, or one uses SHA-1 and the other SHA-256. Compare the same algorithm in the same encoding.
Using SHA-256 to store passwords: A fast hash makes guessing passwords cheap. Use a password hash such as Argon2id or bcrypt.

Frequently asked questions

Can a SHA-256 hash be reversed?

No. Hashes are one-way. Short or common inputs can be guessed by trying many values, which is why passwords need a slow, salted algorithm.

Should I store passwords as SHA-256?

No. Use a password hashing algorithm such as bcrypt, scrypt or Argon2, which are slow and salted on purpose.

Is SHA-1 still safe?

Not for security: practical collisions exist. Use SHA-256 or stronger.

Why is MD5 not included?

MD5 is broken for security and not part of the browser's Web Crypto API. Use SHA-256.

Is my text uploaded?

No. Hashing runs in your browser.

What is a hash used for?

Checking file integrity, detecting changes, removing duplicates, digital signatures and indexing data.

What is HMAC?

A hash combined with a secret key, which proves a message came from someone who has the key. Webhooks such as WhatsApp's are signed with HMAC-SHA256.

What is a salt?

Random data added to each password before hashing, so identical passwords give different hashes and precomputed tables do not work.

How do I check a downloaded file's SHA-256?

On macOS or Linux run shasum -a 256 followed by the file name; on Windows run certutil -hashfile followed by the file name and SHA256. Compare the result with the published value.

Why is my hash different from another tool's?

Usually the input differs: a trailing space or line break, or a different text encoding.