⌘ K
sha-256 · 64 hex chars · web crypto · live

Generate SHA-256 digests

Compute the SHA-256 hash of any UTF-8 text. 256-bit, 64 hex characters. Hashing uses Web Crypto and runs entirely in your browser.

SHA-256 Hash Generator
Input
43 B
43 chars
Algorithm
SHA-256
256-bit
Digest
—
lower
Status
…
web crypto
input · text
output · sha-256 hex
—
Quick Start

How to compute SHA-256: a complete step-by-step guide

SHA-256 is a member of the SHA-2 family standardized in FIPS 180-4 — a one-way cryptographic hash producing a 256-bit (32-byte) digest from arbitrary input. This tool feeds UTF-8 bytes to the browser's crypto.subtle.digest("SHA-256", bytes) Web Crypto API, then formats the result as 64 hex characters. Computation is entirely local — your input never touches a network socket.

  1. 01

    Type or paste any UTF-8 text

    Drop in plain text, JSON, a license key, a file manifest, a passphrase, or any string you need to fingerprint. We encode it with TextEncoder first, so emoji, accents, CJK, and any Unicode character produces a stable, well-defined byte sequence before hashing.

    The same input always yields the same digest (deterministic) — change one bit and the entire digest changes (avalanche effect). For hashing whole files efficiently, the File Checksum Verifier streams data without loading it all in memory.

    UTF-8TextEncoderFIPS 180-4deterministicavalanche
    input · plain text1 line
    hello
    5 B · 5 charsutf-8 · ready
  2. 02

    Choose lowercase or uppercase hex

    The digest is 32 raw bytes; we display it as hex — two characters per byte = 64 characters total. Lowercase is the dominant convention (Git object IDs, OpenSSL, Linux sha256sum); uppercase appears in some vendor checksums and Windows utilities.

    Case affects display only; the underlying bytes are identical. Toggle freely without re-hashing.

    64 hex32 byteslowercaseuppercasedisplay only
    format · caselower
    lowercase   ·   UPPERCASE
    format setFIPS 180-4 § 6.2
  3. 03

    Watch the live 256-bit digest

    Every keystroke triggers a fresh subtle.digest call. The browser computes the hash on the main thread (sub-millisecond for typical inputs) and renders the 64-char hex output. No debounce, no submit, no roundtrip.

    Use the result for content addressing (Git, IPFS, Docker layers), Subresource Integrity (integrity="sha256-…"), HMAC keys, ECDSA/RSA-PSS pre-image, or as a stable cache key.

    Web Cryptosubtle.digest256-bitSRIcontent-addressed
    output · sha-256 hex64 chars
    2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
    32 B · 1 lineFIPS 180-4 · ready
  4. 04

    Copy, download, or combine with HMAC

    One click copies the digest; download saves it as .txt. Past that, SHA-256 rarely stands alone — pair it with the HMAC Generator for authenticated MACs, the JWT Encoder (which uses HMAC-SHA-256 under HS256), or the Bcrypt Generator when you need a deliberately slow password hash instead.

    Important: do not use raw SHA-256 for passwords. It's too fast — a GPU brute-forces billions of guesses per second. Use bcrypt, Argon2, or scrypt for credential storage.

    clipboardHMACJWT HS256not for passwordsprivacy-first
    export · actions3 actions
    ✓ Copied to clipboard
✓ Saved: sha256.txt
✓ 100% client-side
    ready to ship0 outbound
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsSHA-1SHA-512MD5BcryptHMACSHA-3 / Keccak
Use Cases

When to use SHA-256

Integrity, signatures, content addressing.

File integrity

Compare a SHA-256 against a vendor checksum. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Subresource Integrity

Use a SHA-256 in an SRI hash attribute. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Digital signatures

ECDSA and RSA-PSS commonly sign a SHA-256 digest. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Content addressing

Identify blobs by hash in Git, IPFS, Docker. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Cache keys

Hash inputs to derive a deterministic cache key. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Test fixtures

Lock down expected output of a function. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

No. SHA-256 alone is far too fast. Use bcrypt, Argon2, or scrypt — they are intentionally slow and salted.
SHA-256 produces 256 bits, which is 32 bytes — two hex characters per byte = 64 characters.
We encode your text as UTF-8 before hashing. The same characters under a different encoding produce a different hash.
For files use the File Checksum Verifier — it streams large files efficiently.
No. SHA-256 is computed in your browser via Web Crypto and runs locally.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!