SHA-256 Hash Generator: SHA-256, SHA-512, SHA-3 Online
Get the SHA-256 hash of text as you type, or of files of any size, plus SHA-512, SHA-3 and six more. Check downloads against SHA256SUMS files and verify HMAC-SHA256 webhook signatures, all in your browser.
- Nothing uploaded
- 8 algorithms, any file size
- Checked against official test values
HMAC with a secret key (optional)
Other algorithms
-
SHA-512
-
SHA-384
-
SHA-224
-
SHA3-256
-
SHA3-512
-
SHA-1
-
MD5
How to test it
- Type abc without pressing Enter. SHA-256 should start with
ba7816bf, the official FIPS 180 test value. - Paste
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adinto Expected hash. SHA-256 shows Match. - Hash a file here and on your computer (
certutil -hashfile file SHA256,sha256sum fileorshasum -a 256 file). They'll be identical.
Self-check: running…
How this SHA-256 hash generator works
Exact bytes, no changes
Text is converted to UTF-8 exactly as typed and files are read byte for byte. Nothing is trimmed or cleaned, so results match sha256sum, certutil and Get-FileHash.
Eight algorithms, one engine
SHA-256, SHA-224, SHA-384, SHA-512, SHA3-256, SHA3-512, SHA-1 and MD5 are written for this page and stream large files in 4 MB pieces with a progress bar.
Checked every time
When the page loads, it hashes the official FIPS 180 and FIPS 202 test inputs and shows whether each result is correct, so you can trust the numbers before using them.
Check it yourself. Open your browser's developer tools (F12) and choose the Network tab, then type text or choose a file. No requests are made: the hashing code runs on your device.
What people use this SHA-256 generator for
Find your task. Each button sets the tool up for it.
| Your task | How | Action |
|---|---|---|
| Check an ISO, app or ROM download | Choose the file under Files and paste the SHA-256 or the whole SHA256SUMS text into Expected hash. | |
| Verify a Razorpay, Stripe or GitHub webhook signature | Paste the raw body as text, open HMAC, enter your webhook secret and compare HMAC-SHA256 with the signature header. | |
| My hash doesn't match sha256sum | echo adds a line break. Tick Add a newline at the end, or hash the file itself. The yellow warning shows hidden characters. |
|
| I need MD5 or SHA-1 for an old system | Both are listed under Other algorithms. The MD5 page has extra help for legacy checksums. | MD5 generator |
How the hashes are calculated
SHA-256 (FIPS 180-4) turns any input into 256 bits, shown as 64 hex characters, by processing it in 64-byte blocks. SHA-512 and SHA-384 use 128-byte blocks and 64-bit arithmetic. SHA-3 (FIPS 202) uses a different design, the Keccak sponge, so it stays safe even if a weakness is ever found in SHA-2.
All eight algorithms are written for this page without outside libraries. They were tested against Node.js's built-in hashing on random data split at random points, including HMAC with short and long keys.
SHA-256 has no known practical attacks and is used for software downloads, TLS certificates, Git and Bitcoin. MD5 and SHA-1 are included only for old checksums.
Sources: FIPS 180-4 (SHA-2), FIPS 202 (SHA-3), RFC 2104 (HMAC).
Official test values, checked live
Press Try it to load an input exactly. The first row is no text at all, not the words shown.
| Input | Algorithm | Expected | This page |
|---|---|---|---|
| nothing (empty input) | SHA-256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | … |
abc | SHA-256 | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad | … |
abc | SHA-224 | 23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7 | … |
abc | SHA-384 | cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7 | … |
abc | SHA-512 | ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f | … |
abc | SHA3-256 | 3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532 | … |
SHA-256 mistakes to avoid
Common ways a correct algorithm still gives the wrong answer.
SHA-256 is fast, which is bad for passwords. Use Argon2id, scrypt or bcrypt.
If a mirror is hacked, both the file and its checksum change. Take the hash from the official site.
HMAC needs the raw body, byte for byte. Pretty-printed JSON gives a different signature.
Short, predictable inputs aren't hidden by hashing. Every 10-digit number can be tried in minutes.
Good habits with SHA-256
When downloading
- Copy the checksum from the publisher's official page.
- Compare the full 64 characters, not just the start.
- Also verify the GPG or code signature when one is offered.
- Delete and re-download any file that doesn't match.
- Keep the checksum with your backups to spot corruption later.
When building software
- Use SHA-256 or SHA-3 for integrity checks and identifiers.
- Use HMAC-SHA256, not a plain hash, to sign messages.
- Compare signatures in constant time.
- Agree on encoding and line endings before hashing text.
- Use a password hash, never plain SHA-256, for passwords.
Frequently asked questions
Short answers about privacy, algorithms, checksums and webhooks.
Is my text or file uploaded?
No. Every hash is calculated by code on this page, in your browser. Nothing you type or choose is sent to our server, and the page keeps working offline once it has loaded.
Which hash algorithm should I use?
SHA-256 for almost everything: download checksums, file integrity, API signatures and blockchain work. SHA-512 or SHA-3 when a system asks for them. MD5 and SHA-1 only to match old checksums, because both can be forged on purpose.
Why is my hash different from sha256sum or another tool?
Usually an invisible difference in the input: a line break at the end (echo adds one), Windows line endings, or extra spaces. This page warns you about hidden characters. To hash the exact bytes of a file, use the Files tab.
How do I verify a download with a SHA256SUMS file?
Choose the downloaded files in the Files tab, then paste the whole SHA256SUMS text into Expected hash. Each file that matches its line is marked with a green Match.
How do I check a webhook's HMAC-SHA256 signature?
Paste the exact raw request body as text, open HMAC with a secret key, enter your webhook secret and compare the HMAC-SHA256 result with the signature header. Payment gateways such as Razorpay and Stripe sign webhooks this way.
Is there a file size limit?
No fixed limit. Files are read in 4 MB pieces, so multi-gigabyte ISO images work without filling memory. SHA-256 typically runs at 60 to 150 MB per second; SHA-512 and SHA-3 are slower in a browser, so they're off for files unless you tick them.
Can a SHA-256 hash be reversed?
No. But short or predictable inputs, like phone numbers or common passwords, can be found by trying every possibility. For passwords, use a slow password hash such as Argon2 or bcrypt, not SHA-256.