SHA-256 is a cryptographic hash function from the SHA-2 family, published by NIST in 2001. It turns any input, from an empty string to a multi-gigabyte file, into a fixed 256-bit digest, written as 64 hexadecimal characters. The same input always gives the same digest, and a one-bit change gives an unrelated one.

Is SHA-256 secure in 2026?

Yes. There is no known way to find two inputs with the same SHA-256 digest, or to find an input for a given digest, faster than brute force, which would take longer than the age of the universe. It carries 128-bit collision resistance, the level TLS, code signing and Bitcoin rely on.

Can a SHA-256 hash be reversed or decrypted?

No. A hash is one-way by design: the digest holds no information that leads back to the input. What people call "decrypting" a hash is guessing inputs and comparing digests, which works only for short or common inputs such as passwords, and that is why passwords need a slow, salted hash instead.

Should I hash passwords with SHA-256?

Not on its own. SHA-256 is fast, which is the opposite of what password storage needs: an attacker can try billions of guesses a second. Use bcrypt, scrypt or Argon2id, which are deliberately slow and salted. SHA-256 is right for integrity checks, signatures and content addressing.

How does SHA-256 differ from SHA-1 and MD5?

SHA-1 (160 bits) is broken: researchers produced two different PDFs with the same digest in 2017, and browsers and Git have moved away from it. MD5 (128 bits) fell earlier and collisions can be made in seconds. Both are fine as a quick checksum against accidental corruption, and wrong for anything an attacker could touch.

What is HMAC-SHA-256?

An HMAC is a hash keyed by a secret: HMAC-SHA-256 mixes the key into the computation so only someone who knows the key can produce or check the value. It is how webhooks, JWT HS256 tokens and API request signing prove a message came from the right party and was not altered.

Is my text or file uploaded anywhere?

Nothing leaves your browser. The hash is computed on your machine, by the browser's Web Crypto API or a WebAssembly build of the algorithm loaded on first use, and the page makes no request with your input. You can load the page, go offline and keep hashing.

How do I get the SHA-256 of a file?

Drop the file onto the input or choose it with the button, and the tool reads it in your browser and hashes the bytes. Files up to 1 GB work; past that the browser would need the whole file in memory, so the tool declines. Paste the published digest into the Verify field to compare.

Hex, Base64 or Base64url: which should I use?

Hex is the common form: 64 characters from 0 to 9 and a to f, the same value in upper or lower case. Base64 writes the same 32 bytes in fewer characters, and Base64url swaps + and / for - and _ with no padding. Switch the output and the digest is re-encoded, not recomputed.

Why does my digest differ from the command line?

Text is hashed as UTF-8 bytes, which is what every language and command line does by default. A trailing newline changes the digest, so `echo -n` or this tool's input, with no newline added, matches a command-line tool run on a file without one.

SHA-256 hash generator.

Paste text or drop a file and read its SHA-256 digest as you type. SHA-256 is the world's default hash: unbroken since 2001 and hardware-accelerated on most CPUs; everything runs in your browser and nothing is uploaded.256 bits64 hex characters2001 published0 bytes uploaded

Get Pro Hash something

Add shadcn.io to your AI agent. · Pro It installs blocks, icons and templates in your design system from a prompt, with Pro.

Set up MCP

Loading the tool…

Need the UI around it? With Pro, your AI agent builds the form, the result card and the rest of the page from a prompt.

Get Pro

How it works

4 steps, no account. It runs in your browser and nothing is uploaded.

Enter text or a file
Type or paste anything, or drop a file onto the input. The digest updates with every keystroke.
Pick the algorithm and format
SHA-256 is the default; switch to SHA-1, SHA-256, SHA-384 and SHA-512, and read the digest as hex or Base64.
Key it, when you need a signature
Turn on HMAC and enter a secret to sign the input instead of hashing it.
Verify, copy or download
Paste a published digest to confirm a download, or copy and download your own.

The SHA-2 family against the others

SHA-2 is the default for a reason. The family is unbroken and everywhere; SHA-1 and MD5 are checksums, not security; SHA-3 and BLAKE3 are the alternatives.

SHA-256
256 bits, 64 hex characters, since 2001. No known attack. Fast, and hardware-accelerated on most CPUs. Checksums, TLS, Bitcoin, JWT HS256.
SHA-512
512 bits, 128 hex characters, since 2001. No known attack. Faster than SHA-256 on 64-bit CPUs for long inputs. Lockfile integrity, long-term archives.
SHA-384
384 bits, 96 hex characters, since 2001. No known attack; the same engine as SHA-512. TLS cipher suites, Subresource Integrity.
SHA-224
224 bits, 56 hex characters, since 2004. SHA-256 with other starting values, cut to 28 bytes. The 112-bit security level, where a shorter digest matters.
SHA-1
160 bits, 40 hex characters, since 1995. Broken: collisions were found in 2017. Legacy Git objects; not for anything new.
MD5
128 bits, 32 hex characters, since 1992. Broken: collisions in seconds. The fastest, and only for checksums against accidental corruption.
SHA3-256
256 bits, 64 hex characters, since 2015. No known attack. A different construction from SHA-2 (a sponge), immune to length extension; slower in software.
BLAKE3
256 bits, 64 hex characters, since 2020. No known attack. The fastest modern hash, parallel by design. Large files, deduplication.

Where SHA-256 does its work

A digest is a fingerprint. Anything that must prove bytes are the bytes it expected leans on one.

Download checksums
A release ships with its SHA-256 sum. Hash the file you got and compare: one changed byte changes every character.
Lockfiles and integrity
A package manager's lockfile records each package's digest, so an install gets exactly the bytes that were reviewed.
JWT signatures
HS256 signs a JSON Web Token with HMAC-SHA-256 over its header and payload, keyed by the server's secret.
Webhook signatures
Stripe, GitHub and most webhook senders sign each delivery with HMAC-SHA-256 so a receiver can reject forgeries.
TLS certificates
Every certificate in the chain is signed over a SHA-256 digest; SHA-1 certificates stopped being trusted in 2017.
Bitcoin
A block header is hashed twice with SHA-256; mining is the search for a header whose digest starts with enough zeros.
Content addressing
Docker, Git's SHA-256 mode and IPFS name content by its digest, so the same bytes always have the same address.
Subresource Integrity
A script tag's integrity attribute holds a SHA-256, 384 or 512 digest; the browser refuses a file that differs.

Nearby in the hash generators. Every one free, in the browser.

Pricing

Build it with Pro

The tool is free. Pro adds 6,000+ blocks, premium templates and the MCP server, so your AI editor builds the product around it.

See full pricing

4.9/5 out of 5 · 150+ reviewsfrom 150+ founders and developers.

Billing

Billed once a year in USD. Cancel anytime.

Yearly-33%MonthlyLifetimePay once

How many people can use the license.
Client work, SaaS products and anything you charge for.
Production-ready React sections: hero, pricing, features, dashboards and more.
Complete multi-page sites you can ship as they are.
React icons from every major library, installable with one command.
Presets that restyle every block, in light and dark.
Lets your AI editor search, preview and install blocks for you.
Priority requests are answered first.

Individual

For personal projects & open source

$32instead of $49/mo

$389 billed yearly

Seats: 1 seat
Commercial use: Personal & open source only
Pro blocks: 6,000+ blocks
Templates: All 14 templates
React icons: 294k+ icons
Themes: All 59 themes
MCP server: Basic usage
Support: Standard

Team

Organization

For companies with larger teams

$132instead of $199/mo

$1,589 billed yearly

Seats: Unlimited seats
Commercial use: Included
Pro blocks: 6,000+ blocks
Templates: All 14 templates
React icons: 294k+ icons
Themes: All 59 themes
MCP server: Unlimited usage
Support: Priority

Billed once a year in USD. Cancel anytime.

Individual

For personal projects & open source

$32instead of $49/mo

$389 billed yearly

How many people can use the license.Seats: 1 seat
Client work, SaaS products and anything you charge for.Commercial use: Personal & open source only
Production-ready React sections: hero, pricing, features, dashboards and more.Pro blocks: 6,000+ blocks
Complete multi-page sites you can ship as they are.Templates: All 14 templates
React icons from every major library, installable with one command.React icons: 294k+ icons
Presets that restyle every block, in light and dark.Themes: All 59 themes
Lets your AI editor search, preview and install blocks for you.MCP server: Basic usage
Priority requests are answered first.Support: Standard

Team

Organization

For companies with larger teams

$132instead of $199/mo

$1,589 billed yearly

Everything in Team, plus

How many people can use the license.Seats: Unlimited seats
Lets your AI editor search, preview and install blocks for you.MCP server: Unlimited usage

Secure checkout via Stripe
Code lives in your repo
Keep what you've shipped if you cancel
License terms

Questions and answers

Before you trust the result: what to know about the format, the limits and your data.

Build the product around it

Every block, template and icon, installed by your AI agent in your theme. The tools stay free.

Get Pro

Cancel anytimeKeep what you've shipped if you cancel

Explore UI

Popular

Frameworks

Built On

Explore Blocks

Marketing

Application

Explore Charts

Popular

Frameworks

Explore Examples

More Galleries

Explore Icons

More Libraries

Browse

Explore Templates

Categories

Community

Explore Design Systems

Categories

More

Explore Tools

Categories

Explore MCP

Set Up In

Help

Explore Pro

Resources

Legal

SHA-256 hash generator.