SHA-256 Generator

What this tool does

SHA-256 turns any input — a sentence, a 200 MB installer, a signed payload — into the same 256-bit fingerprint every time. This page computes that fingerprint for text you paste or a file you choose, prints it as hex or Base64, and compares it against a checksum you already have. The digest is produced by your browser's own crypto.subtle.digest(), so the file is read off your disk and never uploaded.

The selector also offers SHA-384 and SHA-512 — the same SHA-2 family, wider internally, and for this job different only in digest length: 64, 96 and 128 hex characters.

Common uses

• Verifying a download against the SHA256SUMS file a project publishes — the one job this page is built around.
• Confirming a file restored from a backup is byte-identical to the original.
• Producing a content fingerprint for a cache key, an ETag or a deduplication index.
• Getting the Base64 form a Subresource Integrity attribute or a Content-Security-Policy hash needs.

A short example

Input:

The quick brown fox jumps over the lazy dog

SHA-256, hex:

d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

The same 32 bytes, Base64:

16j7swfXgJRpypq8sAguT41WUeRtPNt2LQLQvzfJ5ZI=

Add a single full stop to the input and every one of those characters changes. That is the point: there is no "close enough" in a digest comparison.

SHA-256 is not a password hashing function

SHA-256 is fast by design — a modern GPU computes billions of operations per second, which is exactly why Bitcoin mining uses it. Speed is a virtue when fingerprinting a 4 GB ISO and a catastrophe for stored passwords, because the same hardware chews through a leaked table at the same rate. Salting defeats precomputed tables but does nothing about raw speed.

Use a deliberately slow, memory-hard, salted algorithm instead: Argon2id first, with scrypt and bcrypt as well-supported alternatives. Each has a cost parameter you raise as hardware improves. SHA-256 has none.

Nor is there any way to reverse a digest. Hashing is one-way and keyless, so nothing here decrypts anything; sites offering to "decrypt SHA-256" are looking your value up in a table of previously hashed common inputs.

Worth knowing

A digest covers bytes, not characters. Text here is hashed as UTF-8, and a trailing newline your editor added silently is enough to break a comparison — check for that before suspecting the file.

SHA-256 has no known collision or preimage attack. The length-extension property it shares with every Merkle–Damgård construction only bites if you invent your own hash(secret ‖ message) scheme. Do not; use HMAC, which is immune by design.