How-to guide

How to Hash Text with SHA-256

To hash text with SHA-256, paste it into a SHA-256 generator and read the 64-character hexadecimal digest. The same input always produces the same digest, and any change produces a completely different one. Use it for integrity checks and signatures. Do not use it to store passwords — it is far too fast, which is exactly what an attacker cracking a stolen database wants.

SHA-256 Hash Generator

Generate a SHA-256 digest — the modern default.

Open the tool

SHA-256 produces a 256-bit digest, written as 64 hexadecimal characters. It is deterministic, so the same input always gives the same output, and it is one-way, so the input cannot be recovered by computation.

That speed is a feature for checksums and a liability for passwords. A modern GPU computes billions of SHA-256 hashes per second, so a stolen database of SHA-256 password hashes falls quickly. Password storage needs a deliberately slow, salted function such as bcrypt, scrypt or Argon2.

Step by step

Paste the exact text
Hashing is byte-exact. A trailing newline, a different line ending or a stray space produces an entirely different digest, which is the usual reason two hashes of "the same" text disagree.
Choose the output encoding
Hexadecimal is the conventional form and is what published checksums almost always use. Base64 is more compact and appears in HTTP headers such as Subresource Integrity.
Compare against the published value
Paste the expected checksum next to the generated one and compare. Comparing the first and last few characters is not sufficient — a deliberate collision attempt would target exactly that habit.
Use HMAC when a secret is involved
To authenticate a message with a shared key, use HMAC-SHA256 rather than hashing the key and message together. A plain hash of secret plus message is vulnerable to a length-extension attack.
Use bcrypt for passwords
If the input is a password destined for storage, SHA-256 is the wrong function. Use bcrypt, scrypt or Argon2, which are deliberately slow and salt each hash automatically.

Example

Note how a single character change produces a completely unrelated digest — the avalanche effect.

Input

hello
hello.

SHA-256 (hex)

2cf24dba5fb0a30e26e83b2ac5b9e29e
1b161e5c1fa7425e73043362938b9824
…
5891b5b522d5df086d0ff0b110fbd9d2
1e41b71104f81d92d5e5e2e0f1d19e14

Frequently asked questions

Can a SHA-256 hash be reversed?

Not by computation. It is one-way. Short or common inputs can still be recovered by looking the digest up in a precomputed table, which is why password storage needs a salted, deliberately slow function rather than a bare SHA-256.

Why do two hashes of the same text differ?

Almost always an invisible difference in the input: a trailing newline, Windows CRLF versus Unix LF line endings, a byte-order mark, or trailing whitespace. Hashing is byte-exact, so any of those changes the result entirely.

Is SHA-256 still considered secure?

Yes. There is no practical collision or preimage attack against it, and it remains the recommended general-purpose hash for integrity and signatures. That is in contrast to MD5 and SHA-1, both of which are broken for collision resistance.

Is my input transmitted?

No. Hashing uses the browser Web Crypto API, so the value you type never leaves your device. As a general habit it is still safer to hash test values rather than live production secrets in any web page.

Should I use SHA-256 or SHA-512?

Either is secure. SHA-512 is often faster on 64-bit hardware despite the longer digest, but SHA-256 is more widely expected by other systems and produces a shorter value. Match whatever you are interoperating with.

Tools used in this guide

All tools →

All guides →

Last reviewed 7 August 2026.