Skip to content
ToolForUser
  • Image CompressorImage Tools · Make photos and graphics smaller by re-encoding them as JPG or WebP, with a quality slider and optional downscaling.
  • Image ResizerImage Tools · Change the width and height of an image in pixels or by percentage, with high-quality downscaling.
  • Image ConverterImage Tools · Change the format of one or many images to JPG, PNG or WebP, with control over quality and transparency.
  • Image CropperImage Tools · Cut out part of an image with a draggable selection, aspect ratio presets and exact pixel inputs.
  • Rotate & Flip ImageImage Tools · Turn a picture by 90° or 180° and mirror it horizontally or vertically, with a live preview.
  • Merge PDFPDF Tools · Combine several PDF files into one document, in the order you choose, with optional page ranges per file.
  • Split PDFPDF Tools · Extract pages into a new PDF or split a document into several files by page, range or fixed page count.
  • Reorder PDF PagesPDF Tools · Change the page order of a PDF with drag and drop, delete unwanted pages and save the result.
  • Rotate PDFPDF Tools · Turn individual pages or the whole document by 90° steps, preview the result and save the corrected PDF.
  • Images to PDFPDF Tools · Combine photos and scans into a single PDF, one image per page, with page size, orientation and margin options.
  • JSON Formatter & ValidatorDeveloper Tools · Validate JSON with precise error locations, then pretty-print, minify or sort keys without changing any value.
  • Base64 Encoder & DecoderDeveloper Tools · Encode text or files to Base64 (standard or URL-safe) and decode Base64 or data: URLs back to text or a downloadable file.

SHA-256 Hash Generator

Calculate SHA-256 checksums of text or large files locally and check them against an expected hash.

Runs locally in your browser – your data is not uploaded

Loading tool…

About the SHA-256 Hash Generator

SHA-256 is a cryptographic hash function from the SHA-2 family. It turns any input – a short word, a document or a multi-gigabyte disk image – into a fixed 256-bit value, usually written as 64 hexadecimal characters. Changing a single bit of the input produces a completely different hash, which is why SHA-256 checksums are the standard way to confirm that a download, backup or copied file is complete and unchanged.

This tool hashes text (encoded as UTF-8) and files. Files are processed by a background worker, and large ones are read in 4 MB pieces and hashed incrementally, so even very big files can be checked without loading them into memory and without freezing the page. Paste the checksum published by the provider to see at once whether it matches.

All hashing happens locally in your browser. Your text and files are never uploaded.

How to use it

  1. Choose Text or Files under Input.
  2. For text, type or paste into Text to hash. The SHA-256 (hex) and SHA-256 (Base64) fields update as you type.
  3. For files, click Choose files or drag one or more files onto the box. They are hashed one after another with a progress bar; Cancel stops hashing and Hash again restarts a cancelled file.
  4. To verify a checksum, paste the expected value into Compare with expected hash. Each result shows Match or No match.
  5. Tick Uppercase hex if you need capital letters, and use the Copy buttons to copy a hash.

Features

  • Files of any size: Files are streamed through the hash in 4 MB chunks inside a Web Worker, so memory use stays low and the page stays responsive. Files up to 64 MB use the browser’s built-in Web Crypto when it is available; larger files use the tool’s own SHA-256 implementation.
  • Checksum comparison: Paste the expected hash as hex in any letter case or as Base64. A line copied from a sha256sum file ("hash filename") or a value prefixed with sha256: also works.
  • Several files at once: Add many files in one go and see the progress, time and speed for each. A single expected hash is compared against every file, which helps to find the right one in a folder of downloads.
  • Hex and Base64 output: Get the digest as lowercase or uppercase hexadecimal and as Base64 – the form used, for example, in Subresource Integrity attributes.
  • Verified implementation: The built-in SHA-256 code is tested against the official FIPS 180-4 test vectors and against an established reference implementation for inputs from 0 bytes to several megabytes.

Examples

Verifying a downloaded installer or ISO image

Download pages often publish a line such as "3f2a…9c1e distro-24.04.iso". Choose Files, add the downloaded ISO, and paste that line into Compare with expected hash. Match means the file is exactly the one the publisher hashed.

Checking that two copies are identical

Add both the original and the backup copy of a file. If both show the same SHA-256, their contents are identical byte for byte, even if names or dates differ.

Creating a Subresource Integrity value

Hash a JavaScript or CSS file you serve from a CDN and copy the Base64 result. Prefixed with sha256-, it goes into the integrity attribute of the <script> or <link> tag.

Understanding a different result from the command line

Typing hello gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. The shell command echo "hello" | sha256sum prints 5891b5b5…6be03 instead, because echo adds a line break. Use echo -n to hash the same bytes.

Limitations and notes

  • SHA-256 on its own is not suitable for storing passwords. It is designed to be fast, so stolen hashes can be attacked with billions of guesses per second. Use a dedicated password hashing function such as Argon2, scrypt, bcrypt or PBKDF2 with a unique salt; use SHA-256 for integrity checks.
  • A matching hash only proves integrity if the expected value comes from a trustworthy source, such as the publisher’s HTTPS page or a signed checksum file. Someone who can replace the file can often replace a checksum stored next to it as well.
  • Text you type or paste has its line breaks normalised to LF by the browser and is encoded as UTF-8. To hash the exact bytes of a text file (for example with Windows CRLF line endings), add the file instead.
  • Empty (0-byte) files are accepted; their SHA-256 is always e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, so this value means the file has no content.
  • Hashing speed depends on your device. Files above 64 MB, or all files in browsers without Web Crypto (for example on pages not served over HTTPS), use the built-in implementation, which is slower than native code.
  • Only SHA-256 is calculated. Other algorithms such as MD5, SHA-1 or SHA-512 are not supported.

Frequently asked questions

Can a SHA-256 hash be decrypted or reversed?

No. A hash is a one-way fingerprint, not encrypted data, so there is nothing to decrypt. The only way to find an input for a given hash is to guess inputs and compare – which is feasible only for short or common inputs such as weak passwords.

Why is my hash different from the one another tool shows?

Almost always the input differs slightly: a trailing line break (echo adds one), Windows versus Unix line endings, a leading or trailing space, or a different text encoding. For files, make sure the download finished and that you compare the right file.

Should I use SHA-256 to store user passwords?

Not by itself. Plain or salted SHA-256 is too fast to resist offline guessing. Password storage needs a deliberately slow, salted algorithm such as Argon2id, scrypt, bcrypt or PBKDF2 with many iterations.

What is the difference between the hex and Base64 output?

Both encode the same 32-byte digest. Hex uses 64 characters (0–9, a–f) and is what checksum files and most websites show. Base64 uses 44 characters and appears in places such as Subresource Integrity and some APIs.

Are my files uploaded to calculate the hash?

No. Files are read directly from your device by this page and hashed in your browser. Nothing is sent over the network, and large files never have to leave your computer.

More free tools