SHA256 Hash Generator

Paste any text and get its SHA-256 digest, the 64-character hexadecimal fingerprint used in TLS certificates, software checksums, blockchains and API signatures. This SHA256 hash generator is handy for checking that two pieces of text are identical or for reproducing a hash another system expects.

Check the tool against known values

These digests are shown split across two lines to fit small screens; the real output is one 64-character line.

abc, the example message in NIST's published test vectors:

ba7816bf8f01cfea414140de5dae2223
b00361a396177a9cb410ff61f20015ad

An empty input, a value you will recognise from AWS Signature Version 4 requests with no body:

e3b0c44298fc1c149afbf4c8996fb924
27ae41e4649b934ca495991b7852b855

hello:

2cf24dba5fb0a30e26e83b2ac5b9e29e
1b161e5c1fa7425e73043362938b9824

The newline trap

The most common "wrong hash" report is really a whitespace difference. echo "hello" | sha256sum hashes six bytes, the word plus a line feed, and prints 5891b5b5…6be03. This page trims spaces and line breaks from both ends before hashing, so it matches echo -n "hello" | sha256sum instead. Two more points: line breaks inside your text are hashed as a single line feed each, so a file saved with Windows CRLF line endings will not match, and text is encoded as UTF-8 before hashing.

How SHA-256 works, briefly

SHA-256 belongs to the SHA-2 family specified in FIPS 180-4. The message is padded to a multiple of 512 bits, then each 512-bit block is mixed into eight 32-bit working values over 64 rounds of additions, rotations and bitwise functions. What remains after the last block is the 256-bit digest. No practical collision or preimage attack is known; finding a collision by brute force would take around 2^128 operations.

Jobs it does, and jobs it does not

• Comparing text. Hash two versions of a config or contract clause; equal digests mean identical text.
• Files. This page hashes text, not uploaded files. To verify a downloaded ISO or APK, run certutil -hashfile file.iso SHA256 on Windows, sha256sum file.iso on Linux or shasum -a 256 file.iso on macOS.
• Bitcoin IDs. Block and transaction IDs are SHA-256 applied twice to binary data and then displayed byte-reversed, so a single pass over pasted text will not reproduce them.
• Subresource Integrity. The integrity attribute needs the Base64 form of the raw digest, so the hex output here cannot be pasted in directly.
• Webhook signatures. Payment gateways such as Razorpay sign webhooks with HMAC-SHA256, which mixes in a secret key; plain SHA-256 cannot reproduce that.
• Passwords. SHA-256 is designed to be fast, which helps attackers guess. Store passwords with a slow scheme from the Bcrypt Hash Generator instead.

Hashing is done on our server, so avoid pasting live secrets such as production API keys.