SHA-256 Hash Generator
Generate a SHA-256 digest from text with the browser's Web Crypto API. The output is a lowercase hexadecimal string that you can compare with a published checksum, use in a fixture, or record beside a build artifact. Processing stays in this tab; the text is not posted to a hash service. The tool also lets you choose SHA-1, SHA-384, or SHA-512 when a protocol specifically requires another digest, but SHA-256 is the default for general integrity checks. A hash is not encryption: anyone who has the same input can calculate the same result.
Use this without the search next time. Prathom Workbench puts Prathom's tools in your toolbar.
Add to Chrome — freeWhat it does
- Browser Web Crypto SHA-256 digest
- SHA-1, SHA-384, and SHA-512 alternatives
- UTF-8 text encoding
- Lowercase hexadecimal output
- Copy result without a server upload
How to use SHA-256 Hash Generator
- 1
Paste the exact text
Enter the text including spaces, punctuation, and line breaks. A single changed byte produces a different digest, so do not add or remove a final newline by accident.
- 2
Choose an algorithm
Leave SHA-256 selected for the common standard. Choose another SHA family member only when the receiving protocol or published checksum names it explicitly.
- 3
Compare the digest
Compare the lowercase hexadecimal result character by character with the trusted value. A matching digest indicates matching input under the selected algorithm.
- 4
Copy the value
Copy the digest into a release note, test fixture, or verification command. Do not use a plain hash as a password storage scheme or secret encryption method.
How it works
Verify the reference
Record the algorithm, exact input representation, and source of the reference digest. Matching bytes do not prove that the publisher or file origin is trustworthy.
Compare hashes correctly
Hash the exact bytes or text you intend to verify, including line endings, whitespace, encoding, and filename changes when those are part of the process. Compare the complete digest consistently; one changed character produces a different value. A matching SHA-256 hash shows that the inputs matched at the time of comparison, but it does not prove who supplied a file or that the source itself was trustworthy.
The page encodes the text with TextEncoder, which produces UTF-8 bytes, and passes
those bytes to crypto.subtle.digest. Web Crypto returns the selected algorithm's
binary digest. The page converts each byte to two hexadecimal characters and joins
them into the conventional lowercase representation. SHA-256 always produces 32
bytes, or 64 hexadecimal characters; SHA-512 produces 64 bytes, or 128 characters.
No normalization is applied before hashing. The tool does not trim whitespace, convert Unicode characters, normalize line endings, or parse JSON. That is deliberate: integrity checks describe bytes, not a cleaned interpretation of the input. The hash also does not authenticate a value by itself. For authenticity, compare it with a checksum delivered through a trusted channel or use a signed release process.
When to use it
Use the generator for a small text checksum, a reproducible test fixture, a protocol value, or a quick comparison with a documented digest. For passwords, use a dedicated password hashing scheme with a unique salt and work factor. For files, hash the bytes with the file checksum page and ensure the downloaded artifact came from a trusted source before treating a matching value as meaningful.
Examples
Hashing a short verification string
This well-known value is useful for checking that the selected algorithm and text encoding agree. Hashing "hello" with a trailing newline would produce a different result, which is why exact input boundaries matter.
Creating a fixture fingerprint
A fixture fingerprint can reveal accidental edits without exposing a larger payload in a log. Keep the exact line-ending convention documented alongside it.
Frequently asked questions
Is SHA-256 encryption or can I reverse the hash?
No. SHA-256 is a one-way hash function, not encryption. It produces a fixed-size digest, and there is no normal decrypt operation that recovers the input. Short or guessable inputs can still be searched by trying candidates, so never use a public hash as a substitute for protecting a secret or password.
Why does adding a space or newline change the result?
The digest is calculated from the exact encoded bytes. A space, line ending, or invisible tab is a real byte, so changing it changes the message and therefore the digest. If two tools disagree, compare the raw text, UTF-8 encoding, and whether either one adds a final newline before comparing algorithms.
Is the text sent to a server to generate the hash?
No. The browser's built-in Web Crypto API performs the digest in this tab and the page does not need a conversion request. Browser extensions, developer tools, or a managed device can have their own visibility, so local execution is a privacy boundary for this page rather than a guarantee about the entire computer.
Can I hash a file with this tool?
Use the file checksum tool when the input is a downloaded archive, installer, or build artifact. This page hashes the text you paste and encodes it as UTF-8. A file checksum must read the file bytes exactly, without converting line endings or decoding it as text first.
Further reading
- Hex Is Twice the Size of Your Data, Base64 Is a Third MoreHex and base64 solve the same problem — get binary through a channel that only carries text — and one of them costs six times as much as the other. Hex still turns up constantly, and usually for a reason that has nothing to do with size.
- Base64 Adds Exactly a Third, Whatever You Put Into ItBase64 has a reputation for making files bigger, and people are vague about by how much. It is exactly a third, every time, for every kind of data — and the reason it is exact is more useful to know than the number.
- How Many Hashtags Should You Use?Two of the four numbers people quote are rules the platforms enforce and two are just conventions, and nobody ever says which is which. One of the real rules fails in a way you would never notice: exceed YouTube's limit and it discards every hashtag on the video, not just the extras.