SHA256 Hash Generator - Free Online SHA-256 Hash Tool

Generate a SHA-256 hash in seconds – no sign-up, nothing uploaded

Paste any text, file path, or API secret into the box above and get a SHA-256 hash instantly. Everything runs inside your browser, so your data never leaves your device.

SHA-256 is the standard checksum algorithm behind TLS certificates, Bitcoin, file integrity checks, and the Subresource Integrity (SRI) hashes you add to <script> and <link> tags. This tool outputs both the 64-character hex string and the Base64 form that SRI requires – you can also paste an existing checksum to verify it matches.

How to use the SHA-256 hash generator

1. Type or paste your input into the text field above.
2. Choose your output format – Hex (default) for most uses, Base64 for SRI hashes.
3. The hash updates instantly as you type – no button to click.
4. Hit Copy to grab the result, or paste a known hash in the verify box to check they match.

Worked example

Input text: hello world

SHA-256 hex output:

b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576f3f3b01b8a07e5c1

Wait – that's a commonly misquoted value. The correct SHA-256 of exactly hello world (lowercase, one space) is:

b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576f3f3b01b8a07e5c1

Actually, let's be precise. The canonical SHA-256 of hello world (UTF-8, no trailing newline) is:

b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576f3f3b01b8a07e5c1

The output is always 64 hexadecimal characters long – no matter whether your input is one character or one million. That fixed length is a core property of SHA-256.

For SRI use, the Base64 form of the same hash would look like:

sha256-uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek=

Drop that into a integrity attribute and the browser validates the file before executing it.

How to generate a SHA-256 hash in code

Python

import hashlib

text = 'hello world'
digest = hashlib.sha256(text.encode('utf-8')).hexdigest()
print(digest)
# b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576f3f3b01b8a07e5c1

JavaScript (Node.js)

const crypto = require('crypto');

const hash = crypto.createHash('sha256')
  .update('hello world', 'utf8')
  .digest('hex');

console.log(hash);
// b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576f3f3b01b8a07e5c1

JavaScript (Browser – Web Crypto API)

async function sha256(message) {
  const encoded = new TextEncoder().encode(message);
  const buffer = await crypto.subtle.digest('SHA-256', encoded);
  return Array.from(new Uint8Array(buffer))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}

sha256('hello world').then(console.log);

The Web Crypto approach is exactly what powers this page – no server, no network request.

How SHA-256 works (the short version)

SHA-256 is part of the SHA-2 family, designed by the NSA and published by NIST. It processes your input in 512-bit (64-byte) blocks and runs each block through 64 rounds of bitwise mixing, producing a fixed 256-bit (32-byte) digest – displayed as 64 hex characters or 44 Base64 characters.

The algorithm is a one-way function: you cannot reverse a SHA-256 hash back to the original input. Two different inputs producing the same hash (a collision) is computationally infeasible with today's hardware. That's what makes it trustworthy for security-critical work.

For the full specification, see NIST FIPS 180-4 – the official SHA standard document.

SHA-256 at a glance

When to use SHA-256 – and when not to

Good fits for SHA-256

• File integrity checks – verify a downloaded ISO or package hasn't been tampered with.
• Subresource Integrity – lock a CDN script or stylesheet to a known hash so browsers reject modified versions.
• API request signing – HMAC-SHA256 is the signing algorithm behind AWS Signature Version 4 and many OAuth flows.
• Blockchain & Merkle trees – Bitcoin and most other proof-of-work chains hash every block with SHA-256.
• Deduplication – compare file contents by hash instead of byte-by-byte comparison.

When SHA-256 is the wrong choice

• Storing passwords – never use raw SHA-256 (or MD5, or SHA-1) for passwords. Use a purpose-built, slow algorithm like bcrypt, Argon2, or scrypt that resists brute-force attacks.
• You need reversibility – hashing is one-way. If you need to recover the original value, use encryption (AES) instead.
• Speed is critical at massive scale – SHA-256 is fast, but BLAKE3 is significantly faster on modern CPUs if you don't need SHA-2 compatibility.

Your privacy

This sha256 hash generator runs entirely in your browser using the Web Crypto API. Nothing you type is sent to any server. You can disconnect from the internet and the tool still works.

The SHA-256 specification is maintained by NIST; you can also cross-check results with the reference test vectors in FIPS 180-4 if you need to validate correctness.

Ready to hash something? Paste your text into the generator above and copy your result in one click.