SHA-256 Hash Generator
Hashes
Compare with a given hash
Paste the checksum you were given: hex, Base64, or a whole line like “abc123… file.iso”.
Check against common passwords
A hash cannot be decrypted, but weak passwords can be guessed. This compares your hash with the hashes of the 10,000 most common passwords, in your browser.
SHA-256 Hash Generator Online
Calculate the SHA-256 hash of a text or a file, create an HMAC-SHA256, or compare a file with the SHA-256 checksum from the download page. The calculation runs in your browser, nothing is uploaded. The page also shows MD5, SHA-1, SHA-384 and SHA-512 of the same data.
How to get a SHA-256 hash
- Type or paste the text: the 64-character SHA-256 appears immediately.
- For a file, open the File tab and drop it (up to 2 GB).
- For an HMAC-SHA256, enter a secret key in the field next to the text.
- To verify a checksum, paste it into the Compare box.
Example: the SHA-256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
What is SHA-256?
SHA-256 is a member of the SHA-2 family, designed by the NSA and published by NIST in 2001 (FIPS 180-2, now FIPS 180-4). It produces a 256-bit hash, written as 64 hexadecimal characters (44 in Base64). No practical attack on it is known, which makes it the standard choice today.
Where SHA-256 is used
- File checksums: Linux distributions, installers and packages publish a SHA-256.
- TLS certificates and code signing: certificates are signed with SHA-256 or stronger.
- Docker and containers: image digests look like
sha256:.... - HMAC-SHA256: signatures of webhooks and API requests (AWS, GitHub, Stripe and many more).
- Bitcoin: block hashing and addresses use double SHA-256.
- Subresource Integrity:
sha256-,sha384-andsha512-values are allowed inintegrityattributes.
A note for developers: do not sign with SHA-256(secret + message)
SHA-256 is vulnerable to length extension: from the hash of secret + message an attacker can calculate the hash of secret + message + more without knowing the secret. Use HMAC-SHA256 (enter the key in the secret field) for signatures. And for passwords use bcrypt or Argon2, not SHA-256.
How to check the SHA-256 of a file
Use the File tab, or the command line:
| System | Command |
|---|---|
| Linux | md5sum file.iso, sha1sum file.iso, sha256sum file.iso |
| macOS | md5 file.iso, shasum -a 1 file.iso, shasum -a 256 file.iso |
| Windows PowerShell | Get-FileHash file.iso -Algorithm MD5 (or SHA1, SHA256, SHA384, SHA512) |
| Windows Command Prompt | certutil -hashfile file.iso SHA256 |
| Any system with OpenSSL | openssl dgst -sha256 file.iso |
Frequently asked questions
How long is a SHA-256 hash?
256 bits: 64 hexadecimal characters, or 44 characters in Base64.
SHA-256 or SHA-3?
SHA-3 (Keccak, 2015) is a different design, standardised as a backup in case SHA-2 is ever broken. SHA-2 has not been broken, so SHA-256 remains the practical choice.
Can SHA-256 be reversed?
No. Only guessed: the check against common passwords box compares your hash with the SHA-256 of the 10,000 most common passwords, locally in your browser.
Is my text or file uploaded?
No, everything stays in your browser.
Similar tools
Free online hash generator: MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of a text or a file up to 2 GB, HMAC, checksum comparison and SRI values. Calculated in your browser, nothing is uploaded.
Free online MD5 hash generator and checker: MD5 of a text or a file up to 2 GB, compare with a given checksum, check against common passwords. Calculated in your browser, nothing is uploaded.
Free online SHA-1 hash generator: SHA-1 of a text or a file up to 2 GB, compare with a given checksum. Calculated in your browser, nothing is uploaded.
Popular tools
Check who hosts a website: the IP address, the hosting company (ASN), the country and the city of the server. Free hosting checker for any domain.
Free IP lookup: find the country, city, coordinates and timezone of an IP address and its host name with a reverse IP (reverse DNS) lookup. IPv4 and IPv6.
Free DNS lookup online: check A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records of any domain, plus its SSL certificate. Find out why a DNS lookup fails.
Check from the United States (New York) whether a website is online: HTTP status code and response time in milliseconds. A free US ping test for any URL.