SHA-256 · text and files
SHA-256 Hash Generator
Get the SHA-256 hash of text or of a file you choose, and check a download against its published checksum - without uploading anything.
Type text or choose a file below.
Hashed in your browser with crypto.subtle.digest(). Files are never uploaded. Verify it
What Is SHA-256?
SHA-256 is a cryptographic hash function from the SHA-2 family, specified by NIST in FIPS 180-4. It turns any input into a 256-bit value, written as 64 hexadecimal characters. The SHA-256 of the three letters abc, for example, starts with ba7816bf; the tool above gives you the full value.
The function is deterministic and one-way: the same input always gives the same hash, and there is no way to compute the input from the hash. It is also designed so that finding two different inputs with the same hash - a collision - is infeasible.
Verify a Download With a Checksum
Many projects publish the SHA-256 of each file they release. To check a download, choose the file in the tool, then paste the published value into "Expected checksum". The tool compares all 64 characters and tells you whether they match - upper or lower case and the sha256sum format (hash file name) both work. One different character means the file is not the one that was published.
The same check on the command line:
- Linux:
sha256sum file.iso - macOS:
shasum -a 256 file.iso - Windows PowerShell:
Get-FileHash file.iso -Algorithm SHA256
What a matching checksum proves
A match shows the file was not corrupted or changed after the checksum was made. It does not show who made it: if an attacker controls the server, they can replace both the file and its checksum. That is why some projects also sign their releases, so you can check the signature with the publisher's key.
What SHA-256 Is Not
Not encryption. Nothing is hidden or protected by hashing; a hash cannot be decrypted, and the input cannot be recovered from it.
Not a password storage scheme. SHA-256 is fast, which is what you want for checksums and what attackers want when they guess passwords against a stolen database. Passwords need a slow, salted password hashing algorithm; see how passwords should be stored.
SHA-256 Hash Generator FAQs
Is my file uploaded to calculate the hash?
No. The browser reads the file on your device and hashes it with crypto.subtle.digest(). No request is made - you can confirm it in your browser's Network tab.
Why is there a file size limit?
The Web Crypto API cannot hash a stream, so the whole file has to be in memory first. The limit of 256 MB keeps the page responsive on ordinary devices. For larger files, use the command-line tools listed above.
Is SHA-256 encryption?
No. SHA-256 is a one-way hash function: no key, no decryption. Encryption algorithms such as AES are reversible with a key. See hashing vs encryption.
Is SHA-256 safe for storing passwords?
Not on its own. It is fast, so stolen hashes can be guessed quickly. Use Argon2id, scrypt, bcrypt or PBKDF2 with a salt - the password storage guide gives current settings.
Is SHA-256 still secure?
No practical collision for SHA-256 has been published, and NIST names SHA-2 as a replacement for SHA-1. That describes current public research, not a guarantee for the future.
Related guides
MD5 vs SHA-1 vs SHA-256
Hashing vs Encryption
