SHA-256 hash generator.

SHA-256 is a cryptographic hash function from the SHA-2 family, published by NIST in 2001. It turns any input, from an empty string to a multi-gigabyte file, into a fixed 256-bit digest, written as 64 hexadecimal characters. The same input always gives the same digest, and a one-bit change gives an unrelated one.

Yes. There is no known way to find two inputs with the same SHA-256 digest, or to find an input for a given digest, faster than brute force, which would take longer than the age of the universe. It carries 128-bit collision resistance, the level TLS, code signing and Bitcoin rely on.

No. A hash is one-way by design: the digest holds no information that leads back to the input. What people call "decrypting" a hash is guessing inputs and comparing digests, which works only for short or common inputs such as passwords, and that is why passwords need a slow, salted hash instead.

Not on its own. SHA-256 is fast, which is the opposite of what password storage needs: an attacker can try billions of guesses a second. Use bcrypt, scrypt or Argon2id, which are deliberately slow and salted. SHA-256 is right for integrity checks, signatures and content addressing.

SHA-1 (160 bits) is broken: researchers produced two different PDFs with the same digest in 2017, and browsers and Git have moved away from it. MD5 (128 bits) fell earlier and collisions can be made in seconds. Both are fine as a quick checksum against accidental corruption, and wrong for anything an attacker could touch.

An HMAC is a hash keyed by a secret: HMAC-SHA-256 mixes the key into the computation so only someone who knows the key can produce or check the value. It is how webhooks, JWT HS256 tokens and API request signing prove a message came from the right party and was not altered.

Nothing leaves your browser. The hash is computed on your machine, by the browser's Web Crypto API or a WebAssembly build of the algorithm loaded on first use, and the page makes no request with your input. You can load the page, go offline and keep hashing.

Drop the file onto the input or choose it with the button, and the tool reads it in your browser and hashes the bytes. Files up to 1 GB work; past that the browser would need the whole file in memory, so the tool declines. Paste the published digest into the Verify field to compare.

Hex is the common form: 64 characters from 0 to 9 and a to f, the same value in upper or lower case. Base64 writes the same 32 bytes in fewer characters, and Base64url swaps + and / for - and _ with no padding. Switch the output and the digest is re-encoded, not recomputed.

Text is hashed as UTF-8 bytes, which is what every language and command line does by default. A trailing newline changes the digest, so `echo -n` or this tool's input, with no newline added, matches a command-line tool run on a file without one.

No. The SHA-256 hash generator is free and opens without a sign-in, an account or an install.

Nothing. The SHA-256 hash generator holds your input in the page's memory, so closing or reloading the tab clears it, and it saves nothing in this browser.

The toolbar switches to SHA-1, SHA-384, and SHA-512 without leaving the page. Each one reads the same input, so you can compare digests side by side.

SHA-256 runs on the browser's own Web Crypto API, so there is nothing to download and it is the fastest path.

Yes: the File to SHA-256 page has the same algorithms and options and opens on the file pane. Files are read in your browser and never uploaded.

Closest to the SHA-256 hash generator: File to SHA-256, Double SHA-256 hash generator, SHA3-256 hash generator, BLAKE3 hash generator. Each opens on its own page, free and in the browser.

The SHA-256 hash generator is one of 64 in its group. The group's page, /tools/hash, lists them all.

The tool is free. Its interface is built from shadcn.io's own components (Button, Input, Slider and the rest of the registry under /ui), which come in React, Vue, Svelte and Solid. Pro adds the blocks and templates for the product around it.