SHA-256 Generator
Compute the SHA-256 digest of any text instantly — with SHA-1, SHA-384 and SHA-512 alongside. Uses WebCrypto when available, with a pure-JS fallback. Includes HMAC demo mode.
Notes
Hashes are one-way: the same input always yields the same digest, and no two different inputs should ever share one (finding a collision is cryptographically infeasible for SHA-256). When you enter an HMAC key, the tool computes HMAC-SHA-256 only — message authentication, not encryption. The WebCrypto path is used on secure contexts (https, localhost); elsewhere a self-contained pure-JS SHA-256 implementation produces identical results. Everything runs in this tab.
How to use SHA-256 Generator
Type or paste text — files work too — and the SHA-256 digest computes locally as you type, presented as both hex and Base64. Paste a checksum from a vendor against your downloaded file's output to verify integrity in one glance; when they match, the file arrived bit-for-bit.
Hashing runs on the browser's native crypto engine, so the speed and output match what Node or openssl would produce for the same bytes. Remember what a hash is not: it is not encryption and it is not a password store — for credentials use a dedicated KDF like bcrypt or Argon2.
Frequently asked questions
What is SHA-256 used for?
Producing a fixed 256-bit fingerprint of any input — file integrity checks, cache keys, signature bases and deduplication. It is a one-way function: the input cannot be recovered from the hash.
Should I hash passwords with plain SHA-256?
Not directly. Fast hashes are unsuitable for passwords — use a salted, deliberately slow KDF such as bcrypt, scrypt or Argon2 instead. This tool is for checksums and keys, not credentials.
Can two inputs have the same hash?
Collisions are theoretically possible but astronomically unlikely for SHA-256, and no practical attack against SHA-2 exists today — one reason the web PKI builds on it.
Is HMAC the same as SHA-256?
HMAC is a construction that wraps SHA-256 with a secret key, producing a keyed hash used for JWT signatures and API signing. This tool outputs plain SHA-256 digests.