SHA-256 hash generator
Compute the SHA-256 hash of text or any file and compare it with a published checksum.
Hashes are computed on your device with the Web Crypto API. Files are never uploaded.
Shortcuts
Verify a download with SHA-256
Software sites often publish a SHA-256 checksum next to the download link. Drop the downloaded file above, paste the published value into “Expected hash”, and the tool tells you whether they match. Any change to the file — even one bit — produces a completely different hash.
Which hash should I use?
| Algorithm | Output | Use it for |
|---|---|---|
| MD5 | 128-bit, 32 hex chars | Legacy checksums only. Broken for security: collisions are easy to create. |
| SHA-1 | 160-bit, 40 hex chars | Legacy systems and Git object IDs. Not collision-resistant; avoid for new security work. |
| SHA-256 | 256-bit, 64 hex chars | The default choice: file checksums, signatures, blockchains, integrity checks. |
| SHA-384 / SHA-512 | 384 / 512-bit | Higher security margin; SHA-512 is often faster on 64-bit CPUs. |
Don’t hash passwords with these. Fast hashes make brute-forcing easy. Store passwords with a slow, salted algorithm such as Argon2id, scrypt or bcrypt.
Frequently asked questions
Can a hash be reversed?
No. Hash functions are one-way. Short or common inputs can sometimes be guessed with lookup tables, which is why passwords need salted, slow hashing.
Why does my hash differ from another tool’s?
Check for a trailing newline or space in the text, and that both tools use UTF-8. For files, make sure you’re hashing the exact same file.
Is there a file size limit?
Files are read into memory, so a few hundred megabytes works on most computers. Very large files may be slow on phones.