SHA-256 Hash Generator Online, Free and Private
Generate the SHA-256 hash of text or a file in your browser and compare it with an expected value. SHA-1, SHA-512 and MD5 are shown too. Nothing is uploaded.
These are the digests of the empty input.
About the SHA-256 hash
This page generates the SHA-256 hash of text or a file in your browser and lets you compare it with an expected value. SHA-256 is the workhorse of modern integrity checks: software downloads, container images, Git commits, TLS certificates and Bitcoin all rely on it. Its digest is 256 bits long, written as 64 hexadecimal characters. Type or paste text, or choose a file of up to 50 MB, and the hash appears at once. Nothing is uploaded, and your data never leaves your device.
How to get a SHA-256 hash
Steps
- Type or paste the text, or press Choose file and pick the file.
- SHA-256 is the first row on this page. Press Copy SHA-256 to copy it.
- Turn on Upper case for capitals or Base64 for the form used in Subresource Integrity attributes and some HTTP headers.
- To verify a download, paste the publisher's checksum into Compare with. The page reports
Matches SHA-256, orNo matchif the file differs.
Privacy
Hashing runs entirely in your browser through the Web Crypto API. Files are read on your device, never uploaded, and nothing is kept once you close the tab.
Why SHA-256
Collision resistant
No practical way is known to produce two different inputs with the same SHA-256 digest, which is what makes it suitable for verifying that a file is exactly the one a publisher released. MD5 and SHA-1, shown further down the list, no longer have that property.
Where it appears
Download pages publish sha256sum files; package managers pin dependencies by SHA-256; Docker image digests are sha256: prefixed; Git is moving its object identifiers to it; and web pages use sha256- integrity attributes for scripts loaded from a CDN. The Base64 toggle gives the form those attributes expect.
Still not a password hash
SHA-256 is fast by design, which is a weakness for password storage. Use Argon2, scrypt or bcrypt for passwords and keep SHA-256 for fingerprints and integrity.
Verifying a download, step by step
- Download the file and the publisher's checksum, often in a
SHA256SUMSfile or on the download page. - Choose the downloaded file here.
- Paste the published checksum into Compare with. A match means the bytes are identical to what the publisher hashed.
- If there is no match, the download is incomplete, corrupted or not the file the publisher released. Download it again from the official source.
Related tools
The full Hash Generator treats all six digests equally, and the MD5 hash page covers the older checksum still printed on many sites. The Base64 Encoder converts a digest for use in a URL or a header, and Text to Hex shows the bytes of the text you hashed.