File checksums
Hash a downloaded file and compare all 64 hex characters with a value obtained from the publisher through a trusted channel. Use the file checksum calculator for raw file bytes.
Exact input, exact digest
Generate a SHA-256 hash online
Enter up to 5,000,000 UTF-16 code units or select a file up to 64 MiB, then copy the 256-bit digest. Files are buffered whole in browser memory, not streamed.
Loading the SHA-256 generator…
Enable JavaScript to calculate the digest locally. The explanatory guide below remains readable.
A fixed 256-bit result
What SHA-256 calculates
SHA-256 is a member of the SHA-2 family standardized by NIST. It processes an arbitrary sequence of bits through compression rounds and emits eight 32-bit words, for a total digest length of 256 bits. The algorithm is deterministic: identical bytes always produce identical output. A one-byte change normally creates a digest with no obvious visual relationship to the original.
Hexadecimal is only a display encoding for those bits. Each hex digit represents four bits, which makes the complete SHA-256 value 64 characters long. Standard padded Base64 represents the same 32 bytes in 44 characters. Converting between these display forms does not rehash the input and does not strengthen or weaken the digest.
The tool converts the current textarea value to UTF-8 before hashing. For plain ASCII, one visible character is usually one byte. Many accented characters, Korean syllables, emoji, and other Unicode code points require multiple bytes. Browser textarea or paste handling can normalize original CR or CRLF line endings to LF. Use file mode when the source's original newline bytes must be preserved.
Text mode enforces a maximum of 5,000,000 UTF-16 code units. File mode accepts at most 64 MiB and reads the complete file into browser memory before calling the digest API. It is intentionally bounded and is not a streaming file implementation; use a native streaming utility for larger artifacts or automated batches.
- Family
- SHA-2, alongside SHA-224, SHA-384, and SHA-512.
- Digest
- 256 bits, 32 bytes, or 64 hexadecimal characters.
- Text input
- UTF-8, limited to 5,000,000 UTF-16 code units.
- File input
- Up to 64 MiB, buffered completely in browser memory.
- Execution
- The browser Web Cryptography API in the current tab.
Reproducible in three steps
How to create and compare SHA-256
- 1
Choose text value or file bytes
Text mode hashes the textarea value after browser newline handling. Choose file mode when original CR, CRLF, LF, BOM, or other source bytes must be reproduced exactly.
- 2
Choose the expected representation
Use 64-character hexadecimal for most checksum lists. Use Base64 only when the receiving protocol specifies it.
- 3
Compare the complete value
Normalize harmless hexadecimal letter case, but never compare a shortened prefix when a security or integrity decision depends on the result.
Integrity workflows
What SHA-256 is used for
Content identifiers
Use a digest to label exact immutable content in caches, build systems, or deduplication workflows. Define how metadata and serialization participate in the hashed bytes.
Protocol building block
SHA-256 participates in HMAC, digital signatures, Merkle trees, and other constructions. Follow the complete protocol rather than substituting a bare digest.
Fixture validation
Pin expected output for a known test vector. Keep file encoding, Unicode normalization, and checkout newline settings stable so the fixture remains reproducible.
Strong primitive, specific limits
SHA-256 does not replace authentication or password hashing
Collision resistance makes it computationally difficult to find two distinct messages with the same SHA-256 digest under current knowledge. That does not attach an identity to a checksum. If an attacker can change a file and the value you compare against, the attacker can simply hash the changed file. Verify a digital signature or obtain the expected digest independently when publisher authenticity matters.
A bare hash also is not a message authentication code. Use HMAC-SHA-256 when parties share a secret and the protocol calls for a MAC; do not invent a construction by concatenating a key and message. Use a reviewed authenticated-encryption scheme when both confidentiality and integrity are required.
Although SHA-256 is useful inside some password-hashing constructions, one fast SHA-256 pass is not suitable password storage. Password databases need unique salts and an intentionally expensive, tunable KDF such as Argon2id, scrypt, bcrypt, or PBKDF2. The application must also define parameter upgrades, secret handling, and account-recovery controls.
Different SHA-256 result?
Compare UTF-8 bytes, Unicode normalization, a possible byte-order mark, spaces, and LF versus CRLF before assuming an implementation is wrong.
Open the byte mismatch guide →Questions answered
SHA-256 generator FAQ
How long is a SHA-256 hash?
A SHA-256 digest is 256 bits, or 32 bytes. It is written as 64 hexadecimal characters or as 44 Base64 characters when the standard padded Base64 representation is used.
Is SHA-256 still secure?
SHA-256 remains an accepted collision-resistant hash for current general integrity uses when implemented correctly. Security still depends on the surrounding protocol, trusted comparison value, and exact bytes being hashed.
Is SHA-256 encryption?
No. SHA-256 is a one-way hash with no decryption key. Encryption is designed to recover plaintext with a key, while a hash is designed to create a deterministic digest for comparison and other constructions.
Can SHA-256 verify a downloaded file?
Yes, if you hash the downloaded file bytes and compare the complete result with an expected SHA-256 value obtained through a trustworthy channel. The checksum alone does not authenticate a publisher when both file and checksum can be replaced.
Should passwords be stored as SHA-256 hashes?
No. SHA-256 is intentionally fast, which makes large-scale password guessing efficient. Store passwords with a dedicated scheme based on Argon2id, scrypt, bcrypt, or PBKDF2, using unique salts and reviewed cost parameters.
Does this SHA-256 generator upload my input?
No. UTF-8 encoding, local file reading, and SHA-256 calculation happen in the current browser tab. Copying a digest, browser extensions, and other device software are separate from the hashing operation.
What are the SHA-256 generator input limits?
Text input is limited to 5,000,000 UTF-16 code units. A selected file is limited to 64 MiB and is read completely into browser memory before hashing, so larger files need a streaming native tool.
Does text mode preserve original newline bytes?
Not necessarily. Text mode hashes the current textarea value as UTF-8, and browser textarea or paste handling can normalize original CR or CRLF line endings to LF. Use file mode to hash the source file's original newline bytes.