SHA-256 maps any input to a fixed 256-bit digest — always 32 bytes, always 64 lowercase hex characters, regardless of whether you hash one letter or a gigabyte. This page encodes your text as UTF-8 and hashes it with crypto.subtle.digest, the browser's native, audited implementation.
Two anchor facts: the empty string always hashes to e3b0c442…7852b855 (worth recognizing — it means “something hashed nothing”), and a single changed bit flips about half the output bits, so SHA-256("hello") starting 2cf24dba… and SHA-256("Hello") starting 185f8db3… share no visible prefix. There is no known practical collision against full SHA-256; the generic birthday attack needs 2¹²⁸ work.
A digest that does not match a published checksum is almost never the algorithm's fault: one different byte — a trailing newline, CRLF vs LF line endings, a UTF-8 BOM — changes all 64 characters. Count the hex characters first (64 = SHA-256, 40 = SHA-1, 32 = MD5) to confirm you are comparing the same algorithm, then hash the exact bytes: for a file, use shasum -a 256 rather than pasting file text.
Verify downloads against published checksums, fingerprint payloads, deduplicate content, generate cache keys — the current default for integrity.
This page is a focused view of theHash Generator (SHA-256 / MD5), which has the full set of options.
No. A hash is a one-way function — the only way to find an input for a given digest is guessing. That is also why identical inputs always produce identical digests.
Any single-byte difference — a trailing newline, CRLF vs LF line endings, a BOM — changes the entire digest. Checksums for files must hash the exact bytes, so paste carefully or hash the file with your OS tools (shasum -a 256).
Not on its own. Passwords need a deliberately slow KDF such as Argon2, scrypt or bcrypt. A single fast SHA-256 lets attackers test billions of guesses per second.