SHA-256 Generator
Developer Tools
Generate SHA-256 hashes from text or files using the Web Crypto API. Output is shown in both hexadecimal and Base64.
Runs entirely in your browserAbout SHA-256 Generator
SHA-256 is a cryptographically secure hash function in the SHA-2 family, producing a 256-bit (32-byte) digest from any input. It's the standard for password hashing primitives (when wrapped with bcrypt/scrypt/argon2), file integrity checks, code signing, blockchain (Bitcoin uses SHA-256), digital signatures, and HMAC authentication. SHA-256 is considered collision-resistant — finding two different inputs that hash to the same output is computationally infeasible with current technology.
This tool uses the browser's built-in `crypto.subtle.digest('SHA-256', ...)`, which is the same hardware-accelerated implementation used by HTTPS, WebAuthn, and the platform's password APIs. You can hash text directly or drop a file (any size — large files are streamed without filling memory). The output is shown in hex (the conventional format) and Base64 (useful for JWTs, Subresource Integrity, and HTTP digest headers). Everything happens locally; nothing is transmitted.
How to use
- 1
Choose Text or File tab
Pick Text to hash a string, or File to hash an uploaded file.
- 2
Provide the input
For text: type or paste it. For file: drop or click to pick.
- 3
Read the hash
The hex and Base64 representations appear below, with per-row Copy buttons.
Examples
Hashing a famous test string
The canonical test from RFC 3174 / NIST examples.
Input
The quick brown fox jumps over the lazy dogOutput
Hex: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
Base64: 16j7swfXgJRpypq8sASuT41WUeRtPNt2LQLQvzfJ5ZI=Hashing an empty string
Useful to memorize — the SHA-256 of the empty string is a well-known constant.
Output
Hex: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855Frequently asked questions
Should I use SHA-256 to hash passwords?+
Not directly. SHA-256 is fast, which is the opposite of what you want for passwords. Use bcrypt, scrypt, or argon2 instead — those are intentionally slow to resist brute force.
What's the difference between hex and Base64 output?+
Both encode the same 32 bytes. Hex is more readable (64 hex characters). Base64 is more compact (44 characters with padding). Use whichever your downstream system expects.
Can I hash a very large file?+
Yes. The browser's Web Crypto API streams the file without loading it entirely into memory, so multi-gigabyte files work — though they may take a few seconds.
Is SHA-256 broken or weak?+
No. SHA-256 is currently considered cryptographically strong; there are no known practical collision attacks. SHA-1 is broken (use SHA-256 instead); MD5 is broken (don't use it for security).
Are my inputs sent anywhere?+
No. Hashing uses the browser's built-in crypto.subtle API. Files are read locally; no network calls.
Related tools
JSON Formatter
Format, beautify, and explore JSON with an expandable tree view. Includes indent control and minify.
JSON Validator
Validate JSON structure and pinpoint syntax errors by line and column.
HTML Formatter
Clean and indent messy HTML for better readability.
CSS Formatter
Format and organize CSS automatically with configurable brace and indent styles.
SQL Formatter
Beautify SQL queries with proper indentation across Postgres, MySQL, SQLite, and MSSQL dialects.
XML Formatter
Format XML into a clean, readable structure with attribute control.