Stax

…

Tools

SHA-256 Hash Generator — Free Online, In Your Browser

Free online SHA-256 hash generator, plus SHA-1, SHA-384 and SHA-512. Instant hashes for any text, computed in your browser so nothing is uploaded.

Last updated:

Was this tool useful?

Use the tool above and you can rate it here.

What is a hash generator?

A hash generator applies a cryptographic hash function to your input and produces a fixed-length hex string — the hash. The same input always produces the same output. Change even one character and the hash changes completely. This makes hashes ideal for verifying data integrity and storing passwords safely.

SHA-256 vs SHA-512

SHA-256 produces a 256-bit (64 hex character) hash. SHA-512 produces a 512-bit (128 hex character) hash. Both algorithms are defined in NIST's FIPS 180-4 Secure Hash Standard, and both are secure. SHA-256 is more widely used and slightly faster on 32-bit systems. SHA-512 has a larger security margin and is faster on 64-bit systems.

How hashing is used in practice

  • File integrity: download a file and verify its SHA-256 hash matches the one published by the vendor.
  • Password storage: never store plain passwords — store the hash (with a salt). bcrypt and Argon2 are better for this than raw SHA, but SHA-256 is the underlying primitive.
  • API authentication: HMAC-SHA256 is used to sign API requests in AWS, Stripe, and most modern APIs.

Common use cases for a hash generator

Security engineers verify the integrity of downloaded software packages by comparing the SHA-256 hash against the vendor's published checksum — any tampering changes the hash completely. DevOps teams include hash checks in CI/CD pipelines to detect file changes between build stages. Backend developers generate SHA-256 hashes as ETags for HTTP caching headers. Content addressable storage systems (like Git, IPFS, and Docker layer storage) use SHA-256 hashes as content identifiers — the hash is the key, and the content is the value.

How the Web Crypto API works

This tool uses crypto.subtle.digest() — the browser's native Web Crypto API, available in all modern browsers (Chrome, Firefox, Safari, Edge). The function is asynchronous and operates on an ArrayBuffer of the UTF-8 encoded input. The output is a raw byte array that is then converted to a hexadecimal string for display. Because the Web Crypto API is built into the browser, no external library is required and no data ever leaves your device.

SHA-1 — still useful but not for security

SHA-1 was deprecated for digital signatures and certificates in 2017 after researchers demonstrated practical collision attacks. However, it is still used in non-security contexts where collision resistance is not required: Git uses SHA-1 for object IDs (upgrading to SHA-256 in newer versions), and some legacy checksum systems still use it. Never use SHA-1 for password hashing, digital signatures, or certificate generation. For all new security applications, use SHA-256 or higher.

Frequently asked questions

What is a cryptographic hash?
A hash function takes any input and produces a fixed-length string (the hash or digest). The same input always produces the same hash. Even a single character change produces a completely different hash. Hashes are one-way — you can't reverse a hash to get the original input.
Which algorithm should I use?
SHA-256 for most purposes — it's the current standard used in TLS, code signing, and password storage. SHA-512 offers more security at slightly more cost. SHA-1 is broken for security purposes (don't use for signatures or certificates) but still used for checksums and Git object IDs.
Is my data sent to a server?
No. This tool uses the browser's built-in Web Crypto API (crypto.subtle.digest). Your text is hashed locally and never leaves your device.
What is a hash used for?
Verifying file integrity (checksums), storing passwords securely (with a salt), digital signatures, data deduplication, and generating unique identifiers. SHA-256 is what Bitcoin uses to secure its blockchain.
Why isn't MD5 included?
MD5 is cryptographically broken — collisions (two different inputs producing the same hash) can be generated in seconds. We only include secure algorithms. If you need to verify an MD5 checksum from a third-party source, any terminal has md5sum built in.
How do I verify a file checksum with SHA-256?
Compare the hash you compute against the one the publisher lists: on Windows run `certutil -hashfile file.iso SHA256`, on macOS/Linux `shasum -a 256 file.iso`, and check the output matches the published value character for character. This tool covers the text side — hashing strings, tokens, and values in the browser.
Is SHA-256 reversible?
No — cryptographic hashes are one-way. You cannot compute the original input from a hash; you can only hash a candidate input and compare. That's the property that makes hashes right for integrity checks and password storage (with salting), and wrong for anything you'll need to read back.
What is the SHA-256 hash of hello?
The SHA-256 of the text hello (no trailing newline) is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Add a newline after it (hello then Enter) and the hash becomes 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03, which is why hashes from command-line tools often differ from pasted text.
Can I use SHA-256 to store passwords?
Not on its own. SHA-256 is designed to be fast, which helps attackers who can test billions of guesses per second. Store passwords with a deliberately slow, salted algorithm such as Argon2, scrypt or bcrypt. Use SHA-256 for checksums, integrity checks and fingerprints.

From the blog

Related tools