SHA-256 Hash Generator
Type text to see its SHA-256 hash instantly, add a secret key for HMAC-SHA256, hash a list line by line, or drop files of any size to get their checksums. Everything runs in your browser and nothing is uploaded.
How to use the SHA-256 Hash Generator
- Choose Text or Files. Type or paste text, or drop one or more files onto the box.
- Pick the output: lowercase hex (most common), uppercase hex or Base64.
- Tick HMAC and enter a secret key if you need a keyed HMAC-SHA256 signature, for example to test a webhook.
- Paste an expected hash in the Verify box to check a download or a signature.
- Copy the result or press Download to save all hashes in sha256sum format.
SHA-256 test vectors
Official values from FIPS 180-4 and RFC 4231 for checking any SHA-256 or HMAC implementation. Type the input above (without quotes) to compare.
| Input | Result |
|---|---|
| SHA-256 of "" (empty) | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA-256 of "abc" | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
| Same, as Base64 | ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= |
| SHA-256 of "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" | 248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1 |
| HMAC-SHA256, key "key", message "The quick brown fox jumps over the lazy dog" | f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 |
| HMAC-SHA256, key 0b0b…0b (20 bytes, hex), message "Hi There" (RFC 4231 case 1) | b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7 |
How SHA-256 and HMAC work
SHA-256 pads the message to a multiple of 512 bits, appends the message length, then mixes each 512-bit block into eight 32-bit state words over 64 rounds of additions, rotations and bitwise functions. The final state is the 256-bit hash. Because each round depends on all previous ones, a change to a single input bit flips about half of the output bits.
HMAC adds a secret key: HMAC(K, m) = SHA-256((K ⊕ opad) ‖ SHA-256((K ⊕ ipad) ‖ m)), where the key is padded to 64 bytes (or hashed first if it is longer), ipad is the byte 0x36 repeated and opad is 0x5c repeated. This construction stays secure even though plain SHA-256(key ‖ message) would be open to length-extension attacks.
Common uses of SHA-256
- Download verification: Linux distributions, Node.js, Python and most open-source projects publish SHA256SUMS files. Compare the hash of your download with the published one.
- Webhook signatures: GitHub sends
X-Hub-Signature-256: sha256=<hex HMAC>and Stripe signstimestamp.payloadwith HMAC-SHA256. Use the HMAC option with the exact raw body to debug a failing check. - Subresource Integrity and CSP:
sha256-followed by the Base64 hash of a script lets browsers refuse a file that was changed. - Content addressing: Docker image digests (
sha256:…), Git's SHA-256 object format and many backup tools name data by its hash.
SHA-256 on the command line
| Task | Command |
|---|---|
| Hash a file (Linux) | sha256sum file.iso |
| Hash a file (macOS) | shasum -a 256 file.iso |
| Hash a file (Windows PowerShell) | Get-FileHash file.iso |
| Hash text without a newline | printf '%s' 'abc' | sha256sum |
| HMAC with OpenSSL | printf '%s' 'message' | openssl dgst -sha256 -hmac 'key' |
| Check a list of checksums | sha256sum -c checksums.sha256 |
Frequently asked questions
What is SHA-256?
SHA-256 is a member of the SHA-2 family of hash functions standardised by NIST in FIPS 180-4. It turns any input into a 256-bit value, usually written as 64 hexadecimal characters. It is used for file checksums, TLS certificates, Git's newer object format, code signing and Bitcoin.
Is SHA-256 secure?
Yes. No practical collision or preimage attack on SHA-256 is known, so it is a sound choice for integrity checks and digital signatures. For storing passwords, though, use a deliberately slow algorithm such as bcrypt, scrypt or Argon2, because SHA-256 is fast enough to test billions of guesses per second on a GPU.
What is HMAC-SHA256?
HMAC combines a secret key with the hash function (RFC 2104) so that only someone who knows the key can create or check the value. Services such as Stripe, GitHub and Slack sign webhooks with HMAC-SHA256, and AWS Signature Version 4 is built on it. Enter the shared secret and the exact request body to reproduce a signature.
Why is my SHA-256 different from another tool?
The hash depends on every byte. This tool hashes text as UTF-8 exactly as typed, including spaces and line breaks. A trailing newline added by echo, Windows CRLF line endings, a different text encoding or a different key format for HMAC will give a different result.
What is the Base64 form of a SHA-256 hash?
It is the same 32 bytes written in Base64 instead of hex, which gives 44 characters ending in '='. Base64 hashes appear in Subresource Integrity attributes, Content-Security-Policy hashes and many API signatures.
How do I check a file's SHA-256 on my computer?
Run sha256sum file on Linux, shasum -a 256 file on macOS, or Get-FileHash file (SHA-256 is the default) in Windows PowerShell. The downloaded checksum list can be verified later with sha256sum -c.