Free Online SHA-256 Hash Generator
Runs in this tab. A token, a key, a config — whatever you paste stays local.
Loading the tool…
How it works
The SHA-2 family, and their digest lengths
SHA-256, SHA-384 and SHA-512 are the SHA-2 family, specified in FIPS 180-4. The number is the digest length in bits: 256 bits is 32 bytes and 64 hex characters, 384 bits is 96 hex characters, 512 bits is 128. SHA-384 is SHA-512 truncated with a different initial state, so on 64-bit hardware it is typically faster than SHA-256 despite the longer output. Computation here uses the browser's WebCrypto SubtleCrypto.digest — the same implementation the browser uses for TLS, not a hand-written one.
- SHA-256
- 32-byte digest, 64 hex characters. The default nearly everywhere.
- SHA-384
- 48-byte digest, 96 hex characters. A truncated SHA-512 internally.
- SHA-512
- 64-byte digest, 128 hex characters. Faster than SHA-256 on 64-bit CPUs.
- Input encoding
- Text is hashed as UTF-8 bytes. Different encodings of the same characters produce different digests, so a trailing newline changes everything.
- One-way
- There is no decrypt. Recovering input from a digest means guessing candidates and hashing them.
How to use it
How to generate a SHA-256 hash online
- 01
Paste the text
The digest updates as you type. Whitespace counts, including a final newline.
- 02
Pick the algorithm
Match whatever produced the value you are checking against.
- 03
Compare the hex
Two digests are equal or they are not — there is no partial match.
Where it earns its keep
Where a text hash is used
- Checking a digest published alongside a release note or a config.
- Producing a stable cache key from a request body.
- Deduplicating records by content rather than by id.
- Confirming two files' contents match by comparing their digests as text.
Questions
SHA Hash, answered
Can I use SHA-256 to store passwords?
No. SHA-2 is designed to be fast, which is exactly wrong for passwords — commodity hardware tries billions of candidates per second. Use bcrypt, scrypt or Argon2, which are deliberately slow and salted per user.
Is hashing the same as encryption?
No. Encryption is reversible with a key; hashing is one-way by design and has no key at all. If you need the original text back, you needed encryption.
Does my text get sent anywhere to be hashed?
No. SubtleCrypto.digest runs in this browser tab. The text appears in no request, which is why you can hash something sensitive without weighing up who runs the site.
Is SHA-256 broken?
No. MD5 and SHA-1 have practical collision attacks and should not be used for integrity; SHA-2 has none. SHA-3 exists as a structurally different backup, not as a replacement forced by a weakness.