SHA-256 Hash Generator

SHA-256 hashing via native Web Crypto

SHA-256 is a member of the SHA-2 family of cryptographic hash functions, standardised in FIPS 180-4. It produces a 256-bit digest from any byte input, rendered here as 64 lowercase hex characters. TextResult calls crypto.subtle.digest("SHA-256", bytes), which is the browser-native implementation backed by the platform crypto library. Same input, same digest, every time, on every device.

SHA-256 is one-way. The function is designed to be infeasible to invert: there is no algorithm that takes a hash and recovers the input. People who claim to have "cracked" a SHA-256 typically mean they have looked up a known short input in a rainbow table or have brute-forced a weak input. The algorithm itself is not reversible. If you need an encoding you can decode, use base64 or URL encode.

SHA-256 is currently considered collision-resistant: no one has published a method for finding two inputs with the same digest in less than infeasible time. That makes it suitable for integrity checks (Git uses SHA-1 for blob identity, but the broader industry has moved to SHA-256), content addressing, blockchain proof-of-work, and digital signatures. For password storage specifically, wrap SHA-256 in a slow KDF like PBKDF2, or use a password-specific function like Argon2 or bcrypt. Plain SHA-256 is too fast on its own for password use.

How to use sha-256 hash generator

1Paste or type the text you want to hash into the input panel.
2The 64-character SHA-256 hex digest appears in the output panel as you type.
3Click Copy in the output header to copy the hash.
4Compare the hash to a known reference (e.g. a published checksum) to verify integrity.
5For password storage, wrap SHA-256 in a slow KDF or use a password-specific function instead.

Keyboard shortcuts

Drive TextResult without touching the mouse.

Shortcut	Action
`Ctrl` `F`	Open the find & replace panel inside the input Plus
`Ctrl` `Z`	Undo the last input change
`Ctrl` `Shift` `Z`	Redo
`Ctrl` `Shift` `Enter`	Toggle fullscreen focus on the editor Plus
`Esc`	Close find & replace, or exit fullscreen
`Ctrl` `K`	Open the command palette to jump to any tool Plus
`Ctrl` `S`	Save current workflow draft Plus
`Ctrl` `P`	Run a saved workflow Plus

What this tool actually does

Fixed 256-bit / 64 hex character output

Every input produces exactly 64 hex characters. The empty string hashes to e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Output is always lowercase hex.

Native `crypto.subtle.digest`

Hashing uses crypto.subtle.digest("SHA-256", bytes), the browser's built-in Web Crypto implementation. That means the digest matches sha256sum on Linux/macOS for the same UTF-8 byte input.

UTF-8 byte input

Text is encoded to UTF-8 bytes via TextEncoder before hashing. café hashes the bytes 63 61 66 C3 A9, matching printf "café" | sha256sum.

Avalanche-sensitive and deterministic

Single-bit input changes flip about half the output bits. The same input always produces the same hash, so SHA-256 is suitable as a content fingerprint and as a key in content-addressed storage.

Async hashing with a per-run token

crypto.subtle.digest returns a Promise. The editor uses a per-run token so a slow hash from an old keystroke cannot overwrite the result of a newer keystroke. Output is always the digest of what is currently in the input.

Worked example

64 hex characters of digest. Same input gives the same output anywhere SHA-256 is implemented correctly. For a 128-bit equivalent, see MD5; for the 160-bit predecessor, see SHA-1.

Input

Hello, world!

Output

315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3

Settings reference

Behaviour	Effect on output
Output format	Always 64 lowercase hex characters (256 bits).
Output length	Fixed regardless of input size.
Empty input	Hashes to `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`.
Non-ASCII text	Widened to UTF-8 bytes before hashing. Matches `sha256sum` on UTF-8 systems.
Whitespace and newlines	Hashed as their literal byte values. A trailing newline changes the digest.
Determinism	Same input always produces the same hash, on every browser.
Reversibility	None. SHA-256 is a one-way function.

FAQ

Can I decrypt a SHA-256 hash?

No. SHA-256 is a one-way hash, not encryption. There is no inverse. Lookup tables for common short inputs exist (rainbow tables), but that is a different thing: pre-computing hashes of common strings and matching yours against the table. The algorithm itself is not reversible.

Is SHA-256 safe for password storage on its own?

Not on its own. SHA-256 is fast, which is the wrong property for passwords. Wrap it in a slow KDF like PBKDF2 with many iterations, or use a password-specific function like Argon2, bcrypt, or scrypt. The slowness is a feature: it caps how fast an attacker with a leaked database can guess.

Why does the SHA-256 differ from another tool?

Almost always a UTF-8 vs UTF-16 mismatch, a trailing newline, or hidden whitespace. TextResult hashes the UTF-8 byte stream, which matches sha256sum on Linux/macOS. Check the input byte length in the status bar at the bottom of the input panel.

How long is the output?

Always 64 hex characters (256 bits). Whether you hash one character or a one-megabyte file, the digest is the same length.

Is the input sent anywhere?

No. Hashing runs entirely in your browser via crypto.subtle. Nothing is uploaded, nothing is logged.

Also known as

sha256 hash generator sha-256 online text to sha256 sha256 checksum sha-2 hash sha256 hex digest compute sha256 256-bit hash