SHA256 hash generator online

How to use the hash generator

1. Choose whether you are hashing text or a file. File mode reads the file directly off your disk in chunks and never sends it anywhere.
2. Pick an algorithm. SHA-256 is the right default for almost everything; SHA-1 is here because older systems still publish SHA-1 checksums, not because you should choose it for new work.
3. Press Generate hash. Text hashes are instant. A large file takes a moment while the browser reads it, and the file size is shown so you know what it is working through.
4. To verify a download, paste the hash published on the download page into the comparison box. You get a plain yes or no, compared character by character so a single altered digit is caught.

What you can use it for

Verifying a download is the everyday use and the one that genuinely matters. Reputable projects publish a SHA-256 checksum next to their installer. Hashing the file you actually received and comparing tells you whether it was corrupted in transit or tampered with on a mirror — a difference of one bit changes the entire hash.

Confirming two files are identical without comparing them byte by byte is fast and reliable. Hash both, compare the strings. This works across machines, over email, and for files far too large to diff, which is why backup and sync tools use it internally.

Developers use hashes constantly for cache keys, deduplication and content addressing. Naming a stored file after the hash of its contents means identical uploads collapse into one copy automatically, and the name changes whenever the content does.

It is also useful for checking that a document has not been altered since you last saw it. Hash a contract when it is signed, store the hash, and you can prove months later whether the copy you are holding is the same file.

Things to know about hashing

A hash is one-way. There is no operation that turns a hash back into the original input, which is the entire point. Sites claiming to "decrypt" a hash are running lookup tables of previously hashed common inputs — they can recognise the hash of "password123" because someone already computed it, not reverse the mathematics.

Do not use plain SHA-256 to store passwords. Fast hashes are the wrong tool: an attacker with a stolen database can compute billions of guesses per second. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2. SHA-256 is for integrity, not for secrets.

SHA-1 is broken for security purposes. Practical collisions — two different files with the same SHA-1 hash — were demonstrated in 2017, and it should not be used where an attacker might benefit from forging a match. It is included here only because legacy systems and older git repositories still use it.

The hash covers exact bytes. A trailing newline, a change of text encoding, or Windows line endings instead of Unix ones will all produce a completely different result. If a text hash does not match what you expected, whitespace at the end of the input is the first thing to check.

Frequently asked questions