Paste text or drop a file to compute its SHA-256 digest: always 64 lowercase hex characters, via crypto.subtle.digest. The empty string hashes to e3b0c442…7852b855. A single changed bit flips about half the output bits. This is the current default for integrity; it is not a password KDF. Hashing stays in this tab.
waiting for input
waiting for input
waiting for input
waiting for input
waiting for input
Runs in this tab · nothing is uploaded · Verify in 10 seconds →
SHA-256 maps any input to a fixed 256-bit digest, always 32 bytes, always 64 lowercase hex characters, regardless of whether you hash one letter or a gigabyte. This page encodes your text as UTF-8 (or reads a dropped file) and hashes it with crypto.subtle.digest, the browser's native, audited implementation.
Two anchor facts: the empty string always hashes to e3b0c442…7852b855 (worth recognizing, it means “something hashed nothing”), and a single changed bit flips about half the output bits, so SHA-256("hello") starting 2cf24dba… and SHA-256("Hello") starting 185f8db3… share no visible prefix. There is no known practical collision against full SHA-256; the generic birthday attack needs 2¹²⁸ work.
A digest that does not match a published checksum is almost never the algorithm's fault: one different byte (a trailing newline, CRLF vs LF line endings, a UTF-8 BOM) changes all 64 characters. Count the hex characters first (64 = SHA-256, 40 = SHA-1, 32 = MD5) to confirm you are comparing the same algorithm (the Verify field does this for you), then hash the exact bytes: for a file, switch to File mode and drop the file rather than pasting its text.
Verify downloads against published checksums, fingerprint payloads, deduplicate content, generate cache keys, the current default for integrity.
This page is a focused view of theHash Generator: SHA-256, SHA-512, SHA-1, MD5, which has the full set of options.
No. A hash is a one-way function, the only way to find an input for a given digest is guessing. That is also why identical inputs always produce identical digests.
Any single-byte difference (a trailing newline, CRLF vs LF line endings, a BOM) changes the entire digest. Checksums for files must hash the exact bytes, so drop the file into File mode (or run shasum -a 256 locally) instead of pasting its contents.
Not on its own. Passwords need a deliberately slow KDF such as Argon2, scrypt or bcrypt. A single fast SHA-256 lets attackers test billions of guesses per second.