What is a hash, and what does SHA-256 do?
A hash function turns any input into a fixed-length fingerprint. The same text always gives the same output, but even a one-character change produces a completely different result, and you cannot work backward from the fingerprint to the original text.
This tool uses SHA-256, which always outputs 256 bits, shown here as 64 lowercase hexadecimal characters. It is computed with your browser's built-in Web Crypto API.
For example, the text Hello, world! hashes to 315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3, and the word hello hashes to 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
Where hashes are used in practice
Developers use hashes to check that a file or message has not changed, to build cache keys, and to create stable identifiers from longer content. Comparing two hashes is much quicker than comparing two large pieces of data.
You may also meet them when verifying a download, where a publisher lists the expected SHA-256 so you can compare it with your own.
One caution: a plain hash is not an encryption method and is not a password storage scheme by itself. Real password storage uses slow, salted algorithms. If you need a strong password in the first place, try the password generator. A hash is also different from encoding, which is reversible, as with the Base64 encoder.
How to generate a SHA-256 hash
- Type or paste your text into the Text to hash box. It starts with the sample text Hello, world!.
- The hash appears below it automatically as you type. There is no submit button.
- Click Copy to put the hash on your clipboard. The button briefly shows a checkmark when it works.
Everything runs locally in your browser, and the page states that your text is never sent anywhere.
Because the output changes on every keystroke, watch for accidental spaces or line breaks. The text in the box is hashed exactly as typed, including trailing whitespace, so "hello" and "hello " give different results.
Limits and what to use instead
This page offers SHA-256 only. There is no algorithm selector, and it hashes plain text rather than files. If you need MD5, there is a separate MD5 generator, but MD5 is considered broken for security purposes and should not be used for passwords, signatures or integrity checks against an attacker. It is fine for non-security jobs such as a quick checksum.
Text is converted to bytes using UTF-8 before hashing, so the same visible text can only match another system's hash if that system also uses UTF-8 and the same line endings.
SHA-256 alone is fast by design, which is a disadvantage for storing passwords. Use a dedicated password-hashing method for that.